Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-clnt-09
Testing for Clickjacking
Passed 21 of 23 test cases with the skill, and 19 of 23 without it.
2 fixed19 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
In a Python security scanner module, what dictionary structure should be appended to the findings list when neither X-Frame-Options nor frame-ancestors is present?
| Checked | Without skill | With skill |
|---|---|---|
| Appends a finding record containing issue description No clickjacking protection | Passed | Passed |
| Sets the severity field of the finding record to Medium | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-CLNT-09
Testing for Clickjacking
Clickjacking (UI redressing) tricks users into clicking hidden elements by overlaying transparent frames over legitimate UI. Attackers can make users unknowingly perform actions like changing settings, making purchases, or granting permissions.
#!/bin/bash
TARGET="https://target.com"
# Check framing protection headers
curl -sI "$TARGET" | grep -iE "x-frame-options|content-security-policy"
# X-Frame-Options values:
# DENY - Cannot be framed
# SAMEORIGIN - Only same origin can frame
test cases passed, vs 19 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.