security-review-owasp-clickjacking-defense

Review browser-facing applications for clickjacking defense weaknesses with evidence-based findings.

Updated Mar 26, 2026

Search Tags:#owasp #clickjacking #csp #security-review #dom #framing #browser-security

Ready to run

npx skills add https://github.com/sjinks/ai-owasp-skillset --skill security-review-owasp-clickjacking-defense

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-review-owasp-clickjacking-defense
Source: https://github.com/sjinks/ai-owasp-skillset/tree/main/.github/skills/security-review-owasp-clickjacking-defense
Command: npx skills add https://github.com/sjinks/ai-owasp-skillset --skill security-review-owasp-clickjacking-defense

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps reviewers identify clickjacking defense weaknesses in browser-facing applications, including framing abuse, cross-origin trust mistakes, and client-side policy gaps that could expose sensitive UI or data.

Core Features & Use Cases

Browser Trust Boundary Review: Checks how pages, headers, and client-side behavior interact with framing, origin rules, and browser-enforced protections.
Evidence-Based Findings: Focuses on confirmed issues with concrete proof from code, configuration, tests, or observable behavior.
Practical Security Review Workflows: Useful when reviewing front-end components, response headers, embedded widgets, third-party scripts, and postMessage or storage flows for clickjacking-related risk.

Quick Start

Ask the skill to review the specified page, component, or trust boundary for clickjacking defense issues and report confirmed findings with evidence.

Frequently Asked Questions about security-review-owasp-clickjacking-defense

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I check my web application for clickjacking defense gaps?▼

A clickjacking defense review validates framing protections, CSP headers, and origin boundaries in front-end code to identify UI redressing vulnerabilities, confirming gaps with concrete evidence from code or observable behavior.

What is clickjacking and how do framing controls protect against it?▼

Clickjacking abuses browser trust boundaries by framing pages to hijack user clicks. Framing controls like CSP frame-ancestors directives and X-Frame-Options headers prevent unauthorized cross-origin embedding of sensitive UI components.

How do I validate CSP and framing protections during a security review?▼

Validate CSP and framing protections by examining response headers, postMessage flows, and sandbox settings for origin boundary enforcement, producing evidence-based findings when controls cannot be verified.

Does this clickjacking review cover third-party widgets and postMessage flows?▼

Yes, the clickjacking review covers third-party widgets and postMessage flows, evaluating how embedded scripts interact with client-side storage and origin boundaries to identify cross-origin trust mistakes.

What are the limitations of automated clickjacking defense reviews?▼

Clickjacking reviews may produce review gaps when controls cannot be verified. Reviewers must manually validate DOM sinks and mixed-content settings that lack observable evidence from code, configuration, or tests.