skills.rest
fatihkan
fatihkanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

sc-csrf

Detect CSRF vulnerabilities in state-changing endpoints across web frameworks.

7|Updated Apr 9, 2026
Search Tags:#vulnerability#web-security#token#csrf#web-application#samesite
One-click install
npx skills add https://github.com/fatihkan/badi --skill sc-csrf-fatihkan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sc-csrf
Source: https://github.com/fatihkan/badi/tree/main/.claude/skills/security-check/sc-csrf
Command: npx skills add https://github.com/fatihkan/badi --skill sc-csrf-fatihkan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

CSRF protection is essential to prevent unauthorized state-changing actions. This Skill detects missing CSRF tokens, SameSite cookie misconfigurations, and CSRF-related issues in JSON content handling, helping teams identify and remediate vulnerabilities before they're exploited.

Core Features & Use Cases

  • Detects missing CSRF tokens on state-changing endpoints (POST, PUT, DELETE) across frameworks.
  • Checks for SameSite cookie misconfigurations that could enable cross-site requests.
  • Validates JSON handling and content-type protections to prevent CSRF bypasses.
  • Provides actionable findings for security assessments, CI pipelines, and code reviews.

Quick Start

Run the CSRF scanner against your web application to identify endpoints lacking CSRF protection.

Frequently Asked Questions about sc-csrf

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect CSRF vulnerabilities in a Django or Laravel web application?▼

CSRF detection checks state-changing endpoints in Spring and Express applications for missing CSRF tokens and SameSite cookie misconfigurations. It also validates JSON content-type handling to identify bypass scenarios.

How does SameSite cookie configuration prevent CSRF attacks in web applications?▼

Detect missing CSRF tokens on POST, PUT, and DELETE endpoints across popular web frameworks. The tool enforces detection rules for missing protections and outputs actionable findings for security assessments and code reviews.

Can I scan API endpoints for CSRF protection if they use JSON content-type handling?▼

Run the CSRF scanner during code reviews or integrate it into CI pipelines to identify endpoints lacking CSRF protection. It provides actionable findings for security assessments before deployment.

What frameworks are supported for CSRF token validation gap detection?▼

JSON content-type bypass scenarios occur when improper content-type handling allows CSRF attacks on API endpoints. The scanner validates JSON handling to detect and prevent these CSRF bypass vulnerabilities.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

csrf

Validate CSRF token enforcement and SameSite attributes on state-changing endpoints.

Community
Advanced
Kisilev13Kisilev13

hunt-csrf

Scans web applications for CSRF vulnerabilities by inspecting CSRF tokens, SameSite cookie settings, and JSON endpoints.

Community
Advanced
daniel-heydari-devdaniel-heydari-dev

Web Security

Provide web security best practices with TypeScript code examples.

Community
Intermediate
CENKSSSCENKSSS

pentest-validation

Validate SAST and DAST vulnerability exploitability through a 4-phase pipeline.

Community
Advanced