security-review-owasp-xs-leaks

What problem does it solve?

This Skill helps reviewers detect cross-site information leaks that reveal authentication state, membership, or protected workflow details through browser-observable behavior.

Core Features & Use Cases

• Framing and isolation review: Checks whether sensitive pages can be embedded, enumerated, or distinguished across origins through framing or browsing-context issues.
• Request and message validation: Examines Fetch Metadata handling, SameSite behavior, CORP, COOP, and postMessage origin checks for weaknesses.
• Response and cache analysis: Looks for timing, redirect, content-length, and cache differences that expose state changes to cross-site attackers.
• Use Case: A reviewer can assess an authenticated dashboard, webhook receiver, or admin page to confirm whether it leaks state through browser side channels.

Quick Start

Use the security-review-owasp-xs-leaks skill to review this web flow for framing exposure, Fetch Metadata gaps, postMessage validation, and response differences.