Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →asdfgh1445/Strix•CSRF 测试
Strix CSRF 测试手册,覆盖 token 绕过、SameSite、CORS 误配与状态变更滥用;触发名:strix-csrf
Passed 16 of 22 test cases with the skill, and 15 of 22 without it.
and 3 more in the full report
4 fixed12 passed either way3 still failing3 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
I am conducting a penetration test on our web portal's user profile and authentication endpoints. Can you draft a structured security assessment plan that outlines how to systematically evaluate these areas for session forgery bugs? Please structure the plan into reconnaissance tasks, high-priority target endpoints, common bypass scenarios to check, and required evidence for validating findings.
| Checked | Without skill | With skill |
|---|---|---|
| Includes preflightless content types like application/x-www-form-urlencoded, multipart/form-data, or text/plain in the reconnaissance plan. | Missed | Passed |
| Includes testing method override mechanisms such as X-HTTP-Method-Override headers or _method parameters. | Missed | Passed |
| Demands demonstrating proof with before and after account state changes for the same user account. | Missed | Passed |
The instructions your model reads when the skill loads.
Cross-site request forgery abuses ambient authority (cookies, HTTP auth) across origins. Do not rely on CORS alone; enforce non-replayable tokens and strict origin checks for every state change.
Session Types
Authentication Flows
OAuth/OIDC
test cases passed, vs 15 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.