Menu
Clickjacking and UI redressing detection — missing frame protection headers and CSP frame-ancestors
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Comprehensive AI-powered security scanning suite with 48 skills covering OWASP Top 10, 7 language-specific deep scanners (Go, TypeScript, Python, PHP, Rust, Java, C#), supply chain analysis, infrastructure-as-code scanning, and 3000+ checklist items. Use when you need to run a security audit, find vulnerabilities, scan a PR for security issues, or perform a penetration test on a codebase.
C#/.NET-specific security deep scan
Go-specific security deep scan
Java/Kotlin-specific security deep scan
PHP-specific security deep scan
Python-specific security deep scan
| name | sc-clickjacking |
| description | Clickjacking and UI redressing detection — missing frame protection headers and CSP frame-ancestors |
| license | MIT |
| metadata | {"author":"ersinkoc","category":"security","version":"1.0.0"} |
Detects clickjacking vulnerabilities where applications can be embedded in iframes on malicious sites, tricking users into clicking hidden elements. Checks for missing X-Frame-Options header, missing Content-Security-Policy frame-ancestors directive, and framebusting bypass vulnerabilities.
Called by sc-orchestrator during Phase 2 when web applications serving HTML are detected.
"X-Frame-Options", "frame-ancestors", "DENY", "SAMEORIGIN",
"helmet", "frameguard", "X_FRAME_OPTIONS",
"SECURE_BROWSER_XSS_FILTER", "clickjack"
X-Frame-Options header set? (DENY or SAMEORIGIN)Content-Security-Policy: frame-ancestors set?// VULNERABLE: No frame protection headers
app.get('/', (req, res) => {
res.send('<html>...'); // Can be iframed by any site
});
// SAFE: Using helmet
const helmet = require('helmet');
app.use(helmet.frameguard({ action: 'deny' }));
// Or CSP
app.use(helmet.contentSecurityPolicy({
directives: { frameAncestors: ["'self'"] }
}));
# Django settings.py
X_FRAME_OPTIONS = 'DENY' # SAFE
# If missing → VULNERABLE
// SAFE: Set header in middleware
func securityHeaders(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("X-Frame-Options", "DENY")
w.Header().Set("Content-Security-Policy", "frame-ancestors 'none'")
next.ServeHTTP(w, r)
})
}
X-Frame-Options: DENY and Content-Security-Policy: frame-ancestors 'none'.