hunt-csrf

90 / 100 · Low risk

Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By elementalsouls/Claude-BugHunter (GitHub) · security · 5,515 stars · scanned at commit d5dcc53

Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET (GitLab $3,370), framework-wide CSRF middleware disabled (Stripe Dashboard $5,000), path-traversal CSRF-token bypass (GitHub Enterprise CVE-2022-23732 $10k), Origin-omission bypass (TikTok $2,500), OAuth-state null-byte (Streamlabs), WebSocket CSRF / CSWSH (Coda), default-SameSite email-change → ATO …

Works with any agent that supports SKILL.md skills.

What this skill can do

Sends data to these websites: target.com, monitoring.target.com, argocd.internal.victim.com, attacker, target

The author does not mention this. Expected for a security skill.

Found in 10 places.

skills/hunt-csrf/SKILL.md, line 103fetch('/api/heartbeat', {method: 'POST', body: JSON.stringify(data)})
skills/hunt-csrf/SKILL.md, line 178curl -s -X POST https://target.com/settings/email \
skills/hunt-csrf/SKILL.md, line 187TOKEN_A=$(curl -s https://target.com/settings -H "Cookie: session=SESSION_A" \

Show 7 more

skills/hunt-csrf/SKILL.md, line 191curl -s -X POST https://target.com/settings/update \
skills/hunt-csrf/SKILL.md, line 206curl -sI https://target.com/login | grep -i "set-cookie"
skills/hunt-csrf/SKILL.md, line 214curl -s https://monitoring.target.com/api/health | jq '.version'
skills/hunt-csrf/SKILL.md, line 302- Payload: hosted on `marketing.victim.com`, target `argocd.internal.victim.com` → `fetch('https://argocd.internal.victim.com/api/v1/applications', {method:'POS
skills/hunt-csrf/SKILL.md, line 342**Payload shape:** from a logged-in low-priv session, `fetch('/bff/admin/users/delete?id=42', {credentials:'include', headers:{'X-CSRF':'1'}})` — succeeds if th
skills/hunt-csrf/SKILL.md, line 348**Payload shape:** cross-origin page opens `new WebSocket("wss://bff.example.com/hubs/admin")` — browser sends session cookie, no `X-CSRF` required, attacker in
skills/hunt-csrf/SKILL.md, line 3601. `curl https://target/bff/user -H 'X-CSRF: 1' -b '<session>'` — dumps the full claim set including internal IDs, role names, tenant IDs (info disclosure on it

Runs commands on your computer

The author does not mention this. Expected for a security skill.

Found in 4 places.

skills/hunt-csrf/SKILL.md, line 178curl -s -X POST https://target.com/settings/email \
skills/hunt-csrf/SKILL.md, line 187TOKEN_A=$(curl -s https://target.com/settings -H "Cookie: session=SESSION_A" \
skills/hunt-csrf/SKILL.md, line 200grep -Eo 'name="(csrf|_token|authenticity_token|csrfmiddlewaretoken)"[^>]*value="[^"]+"'

Show 1 more

skills/hunt-csrf/SKILL.md, line 214curl -s https://monitoring.target.com/api/health | jq '.version'

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'hunt-csrf' ] || [ -L ~/.agents/skills/'hunt-csrf' ]; then echo 'A skill folder named hunt-csrf already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/elementalsouls/Claude-BugHunter' "$d" && git -C "$d" checkout --quiet 'd5dcc5347675ed431488e0a0e46749e4918aa194' -- 'skills/hunt-csrf' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/hunt-csrf' ~/.agents/skills/'hunt-csrf' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'hunt-csrf' ~/.claude/skills/'hunt-csrf' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for elementalsouls/Claude-BugHunter shows the score of its lowest-scoring skill.

SkillTrust badge for elementalsouls/Claude-BugHunter

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/elementalsouls/Claude-BugHunter.svg)](https://zalavijaysinh.github.io/skilltrust/repos/elementalsouls/Claude-BugHunter/)

Score history

Date	Version	Score
2026-11-10	`d5dcc53`	90
2026-11-08	`42a3ab1`	90
2026-11-06	`3e71af0`	80