csrf
Detects forms and state-changing endpoints missing CSRF protection. Use when writing HTML forms that submit POST/PUT/DELETE requests, configuring session cookies, or setting up CSRF middleware for web applications. Also invoke when disabling or bypassing CSRF protections in framework configuration.
Install
With your agent
Install OMGSkills skill "thejefflarson/soundcheck:.claude/skills/csrf" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/csrf ~/.claude/skills/csrfFrom README
Cross-Site Request Forgery Check (A01:2025) What this checks Protects against cross-site request forgery, where an attacker tricks an authenticated user's browser into submitting a state-changing request the user did not intend. Exploitation leads to unauthorized fund transfers, account takeover, or privilege escalation. Vulnerable patterns HTML form posting a state-changing request with no CSRF token hidden field Framework CSRF protection explicitly disabled or exempted on a state-changing endpoint Session cookie issued without a SameSite attribute (Lax or Strict) Web app with no CSRF middleware registered for cookie-authenticated state-changing routes Cookie-authenticated API endpoint accepting POST/PUT/PATCH/DELETE with no token check Fix immediately Flag the vulnerable code and explain the risk.
More from this repo
authentication-failures
Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
broken-access-control
Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
concurrency-correctness
Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...