菜单
Detects forms and state-changing endpoints missing CSRF protection. Use when writing HTML forms that submit POST/PUT/DELETE requests, configuring session cookies, or setting up CSRF middleware for web applications. Also invoke when disabling or bypassing CSRF protections in framework configuration.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Detects supply-chain risks in dependency manifests, lockfiles, install commands, and CI pipelines — missing lockfiles, absent vulnerability scanners, unverified installs, install hooks that pipe remote content to a shell, and AI-hallucinated package names. Use when writing package install commands, dependency manifests, CI/CD configs, build scripts, or code that loads external packages.
Deep review that audits API contracts for mismatches between what callers assume and what implementations enforce. Designed for nightly CI, pre-release scans, or manual deep audits — runs in tens of minutes, not seconds. Surfaces bugs that single-pass OWASP review misses — caller/callee invariant gaps, trust-anchor confusion, predicate misnaming.
Runs a full OWASP/CWE security audit via isolated subagents. Use when the user types /security-review or explicitly requests a full security audit of the current code.
Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code. Use when writing login flows, session management, password storage, JWT handling, MFA implementation, credential validation, or any code that authenticates users. Also invoke when implementing "remember me" functionality or API key management.
Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users' resources. Use when writing code that checks authorization, enforces resource ownership, handles IDOR (object-level authorization), processes server-side requests to external URLs, or implements access control middleware.
Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock, lock-free atomics use the wrong memory ordering, or double-checked locking is missing the necessary barrier. Use when writing or modifying code that acquires multiple locks, uses atomic operations with explicit memory orders (std::memory_order_*, atomic.LoadAcquire, Ordering::Relaxed), implements lazy initialization with double-checked locking, or calls a blocking operation (I/O, sleep, await, blocking channel send) inside a locked region.
| name | csrf |
| description | Detects forms and state-changing endpoints missing CSRF protection. Use when writing HTML forms that submit POST/PUT/DELETE requests, configuring session cookies, or setting up CSRF middleware for web applications. Also invoke when disabling or bypassing CSRF protections in framework configuration. |
Protects against cross-site request forgery, where an attacker tricks an authenticated user's browser into submitting a state-changing request the user did not intend. Exploitation leads to unauthorized fund transfers, account takeover, or privilege escalation.
SameSite attribute (Lax or Strict)Flag the vulnerable code and explain the risk. Then suggest a fix that establishes these properties:
Authorization: Bearer headers, not cookies), the opt-out must be explicit
and the cookie-auth path must remain protected.SameSite=Lax at minimum, or SameSite=Strict for
sensitive flows, plus Secure and HttpOnly. This blocks cross-origin
cookie attachment on top-level navigations or subrequests that don't need it.Referer headers — they live
in a hidden form field or a dedicated request header, never in the query string.Translate these principles to the audited file's language and framework. Use the documented CSRF middleware and template helpers for that stack — do not hand-build token comparison logic.
Confirm the following properties hold (language-agnostic):
SameSite=Lax or SameSite=Strict attribute