OpenAgentSkill Registry Manifest
Skill: hunt-csrf
Slug: elementalsouls-hunt-csrf
Category: security
Description: Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET (GitLab $3,370), framework-wide CSRF middleware disabled (Stripe Dashboard $5,000), path-traversal CSRF-token bypass (GitHub Enterprise CVE-2022-23732 $10k), Origin-omission bypass (TikTok $2,500), OAuth-state null-byte (Streamlabs), WebSocket CSRF / CSWSH (Coda), default-SameSite email-change → ATO (YoYo Games $400), social-account-link CSRF (HackerOne), JSON-CSRF via text/plain on email-change (TikTok $500). Use when hunting modern CSRF — heavy emphasis on chain-to-ATO patterns.

Agent fit:
- Decision: 94/100 Production-ready
- Primary fit: Coding agents
- Role: Primary pick

Supply profile:
- Track: Coding and developer agents
- Scenario: Coding agents
- Applicable agents: Claude Code, Browser agents, CLI, Codex, Cursor
- Maintenance: 2d since push
- Risk: Needs review

Trust:
- Trust score: 70/100 Manual review
- Audit: 80/100 Needs review

Attribution:
- Status: Registry indexed
- Source: recursive skill source sync
- Creator: elementalsouls
- Claim URL: https://www.openagentskill.com/skills/elementalsouls-hunt-csrf#claim-this-skill

Install:
npx skills add elementalsouls/Claude-BugHunter --skill hunt-csrf

URLs:
- Web: https://www.openagentskill.com/skills/elementalsouls-hunt-csrf
- API: https://www.openagentskill.com/api/agent/skills/elementalsouls-hunt-csrf
- Install API: https://www.openagentskill.com/api/skills/elementalsouls-hunt-csrf/install
- Repository: https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-csrf