What problem does it solve? Security testers need a controlled, evidence-gated way to determine whether sensitive pages can be embedded in attacker-controlled frames, without deceiving real users or causing irreversible side effects. ## Core Features & Use Cases - Framing Policy Verification: Checks for missing CSP frame-ancestors and X-Frame-Options headers and confirms actual cross-origin embeddability in a browser. - Safe Action Oracle: Uses only reversible, low-risk actions on self-owned test accounts to prove exploitability without triggering payments, emails, or permission changes. - Evidence Collection: Captures response headers, browser console and frame screenshots, and before/after states of reversible actions for reporting. - Use Case: During an authorized web assessment, confirm that a settings page lacking X-Frame-Options can be framed from an external origin and that a reversible preference toggle completes without extra confirmation. ## Quick Start Ask the agent to run the clickjacking specialist route against the authorized target's sensitive settings page and report whether it can be framed and acted on safely.
