skills.rest
sjinks
sjinksCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-review-owasp-clickjacking-defense

Review browser-facing applications for clickjacking defense weaknesses with evidence-based findings.

Updated Mar 26, 2026
Search Tags:#owasp#clickjacking#csp#security-review#dom#framing#browser-security
One-click install
npx skills add https://github.com/sjinks/ai-owasp-skillset --skill security-review-owasp-clickjacking-defense
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review-owasp-clickjacking-defense
Source: https://github.com/sjinks/ai-owasp-skillset/tree/main/.github/skills/security-review-owasp-clickjacking-defense
Command: npx skills add https://github.com/sjinks/ai-owasp-skillset --skill security-review-owasp-clickjacking-defense

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps reviewers identify clickjacking defense weaknesses in browser-facing applications, including framing abuse, cross-origin trust mistakes, and client-side policy gaps that could expose sensitive UI or data.

Core Features & Use Cases

  • Browser Trust Boundary Review: Checks how pages, headers, and client-side behavior interact with framing, origin rules, and browser-enforced protections.
  • Evidence-Based Findings: Focuses on confirmed issues with concrete proof from code, configuration, tests, or observable behavior.
  • Practical Security Review Workflows: Useful when reviewing front-end components, response headers, embedded widgets, third-party scripts, and postMessage or storage flows for clickjacking-related risk.

Quick Start

Ask the skill to review the specified page, component, or trust boundary for clickjacking defense issues and report confirmed findings with evidence.

Frequently Asked Questions about security-review-owasp-clickjacking-defense

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check my web application for clickjacking defense gaps?▼

A clickjacking defense review validates framing protections, CSP headers, and origin boundaries in front-end code to identify UI redressing vulnerabilities, confirming gaps with concrete evidence from code or observable behavior.

What is clickjacking and how do framing controls protect against it?▼

Clickjacking abuses browser trust boundaries by framing pages to hijack user clicks. Framing controls like CSP frame-ancestors directives and X-Frame-Options headers prevent unauthorized cross-origin embedding of sensitive UI components.

How do I validate CSP and framing protections during a security review?▼

Validate CSP and framing protections by examining response headers, postMessage flows, and sandbox settings for origin boundary enforcement, producing evidence-based findings when controls cannot be verified.

Does this clickjacking review cover third-party widgets and postMessage flows?▼

Yes, the clickjacking review covers third-party widgets and postMessage flows, evaluating how embedded scripts interact with client-side storage and origin boundaries to identify cross-origin trust mistakes.

What are the limitations of automated clickjacking defense reviews?▼

Clickjacking reviews may produce review gaps when controls cannot be verified. Reviewers must manually validate DOM sinks and mixed-content settings that lack observable evidence from code, configuration, or tests.

Related Skills

Explore More Software Engineering Skills→
engineers-hub-ltd-in-house-projectengineers-hub-ltd-in-house-project

security-headers

Implement HTTP security headers with TypeScript middleware for web applications.

Official
Intermediate
Sir-chawakornSir-chawakorn
9

configure-security-headers-csp

Configure HTTP security headers and strict nonce-based Content-Security-Policy directives.

Community
Advanced
sjinkssjinks

security-review-owasp-cookie-theft-mitigation

Detect cookie theft mitigation weaknesses in browser-facing applications.

Community
Advanced
0xShe0xShe
386

php-config-audit

Audit PHP configuration files and runtime settings for security misconfigurations.

Community
Advanced