AI Agent Skills

Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424…

The Prime Cross Site Request Forgery (CSRF) Audit and Exploitation Toolkit.

API design conventions, namespace coordinate system, RBAC roles, ClawHub compatibility layer, OpenAPI contract sync rules, and CSRF/session handling.

Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token,…

Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profi…

Use when debugging or preventing errors in Frappe Client Scripts. Prevents TypeError, frappe.call failures, async/await mistakes, cur_frm vs frm confusion, field not fou…

Security guidelines for WordPress plugin development: sanitization, validation, escaping (in PHP and in admin JavaScript), nonces, capabilities over objects, multisite p…

Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, secure sessions and cookies, encrypt OAuth tokens, track IP addresses, and…

Audit the web/API attack surface - authn/authz on endpoints, CORS, CSRF, SSRF, security headers, rate limiting, mass assignment, and OWASP API Top 10. Use for /perimeter…