Skip to content
TrustedSkillsbeta
Back to all skills

Csrf Protection

Checked
aj-geddes·vlatest·security·MIT

Csrf Protection safeguards against Cross-Site Request Forgery attacks by validating user requests, ensuring data integrity and preventing malicious manipulation.

Repository

Install on your platform

Showing Claude Code. One command installs this skill into any of the agents below.

  1. 1

    Run this in your project

    terminal
    $ npx skills add aj-geddes/useful-ai-prompts --skill csrf-protection -a claude-code

  2. Uses the open-source skills CLI and needs Node.js. Add -g to install it for your user instead of this project.

What we know about this skill

Publisher

aj-geddes

Taken from the source listing. We haven't verified who controls this account.

Install target

Live repository

Not pinned. Installing fetches whatever the repository holds at the time you run the command.

No human has reviewed this code. The checks below are a static scan of the files at one commit — nobody has run this skill or judged whether it works. A skill runs with whatever access you give your agent, so read the source before you install it.

Automated safety checks

scanned

This skill passed all 6 checks. We read its files at one commit and looked for the things that make a skill dangerous to run — not for whether it works.

  • Declares what it does: passed

    SKILL.md parses and declares a name and a description.

    SKILL.md exists, its frontmatter parses, and it declares a name and a description.

  • No undeclared network calls: passed

    Makes no network calls.

    Every host the skill dials — from its scripts, its config endpoints or the commands it tells the agent to run — is either well-known package and API infrastructure or declared in its own frontmatter. Links in documentation are not counted.

  • No obfuscated payloads: passed

    No encoded or obfuscated payloads.

    No base64, hex or compressed blob is decoded and then executed, and no encoded shell commands.

  • No credential access: passed

    Reads no keys, tokens, keychains or credential files.

    Neither the code nor the SKILL.md instructions read SSH keys, cloud credentials, keychains, token stores, browser cookie databases or dotfiles that hold secrets.

  • No pipe-to-shell installers: passed

    No pipe-to-shell or download-and-run installers.

    No `curl … | sh` pattern, in the code or in the instructions, that runs code fetched at run time.

  • Pinned to a commit: passed

    Scanned aj-geddes/useful-ai-prompts at 3f5182cfd7.

    The exact upstream commit SHA that was scanned is recorded, so the result refers to specific bytes.

Commit
3f5182cfd7
Manifest
skills/csrf-protection/SKILL.md
Scanned
7 files, 640 lines
This is a static scan, not a review. It reads the skill's files; it does not run them, and it cannot tell you whether the skill is any good or whether the code does what its description says. A skill runs with whatever access you give your agent.
What each check looks for →

About this skill

The csrf-protection skill enables AI agents to identify and mitigate Cross-Site Request Forgery vulnerabilities during web interactions. It ensures that state-changing requests are validated against authentic user sessions, preventing unauthorized actions on behalf of authenticated users.

When to use it

  • Before an agent submits forms or performs transactions on a target website.
  • When analyzing API endpoints that modify data without explicit authentication headers.
  • During security audits of web applications where session hijacking is a risk.
  • To validate that cookies and tokens are properly bound to specific domains.

Key capabilities

  • Detects missing or weak CSRF tokens in HTML forms and AJAX requests.
  • Verifies that SameSite cookie attributes are correctly configured.
  • Identifies vulnerabilities where state-changing operations lack origin validation.
  • Simulates attack vectors to test the robustness of existing defenses.

Example prompts

  • "Scan this website for potential CSRF vulnerabilities in its login and payment forms."
  • "Analyze the API response headers to determine if they include necessary anti-CSRF measures."
  • "Generate a test payload to verify if this endpoint is susceptible to cross-site request forgery."

Tips & gotchas

Ensure the target application supports standard CSRF token mechanisms before relying solely on automated detection. This skill complements, but does not replace, manual security testing for complex custom authentication flows.