[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6PF0GS58WA6Y63P2JFKF6R3":3,"skill-same:01M6PF0GS58WA6Y63P2JFKF6R3":88},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":6,"ownerHtmlUrl":54,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":55,"install":56,"resources":69},"01M6PF0GS58WA6Y63P2JFKF6R3","validating-csrf-protection",null,"This skill helps to identify Cross-Site Request Forgery (CSRF) vulnerabilities in web applications. It validates the implementation of CSRF protection mechanisms, such as synchronizer tokens, double-submit cookies, SameSite attributes, and origin validation. Use this skill when you need to analyze your application's security posture against CSRF attacks or when asked to \"validate csrf\", \"check for csrf vulnerabilities\", or \"test csrf protection\".","sandraschi\u002Fdocumentation-mcp","sandraschi","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F34750307?v=4","01M6C42H9WE5EC9CK3N5RGZP8S","Sandra Schipal","01M6PE1X2FZP8KR5GANPPFTHA8",2,"MIT","https:\u002F\u002Fgithub.com\u002Fsandraschi\u002Fdocumentation-mcp\u002Fblob\u002Fmaster\u002Fdocs\u002Fnot-mcp-related\u002Fclaude-skills\u002Ftemp\u002Fcode-plugins\u002Fplugins\u002Fsecurity\u002Fcsrf-protection-validator\u002Fskills\u002Fcsrf-protection-validator\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"csrf protection","csrf","Validating CSRF Protection","protection","security posture","synchronizer","for","attributes","you","attacks","submit","as","tokens","test","use","check","analyze","applications","cookies","web","2026-11-10 10:12:30",false,"---\nname: validating-csrf-protection\ndescription: |\n  This skill helps to identify Cross-Site Request Forgery (CSRF) vulnerabilities in web applications. It validates the implementation of CSRF protection mechanisms, such as synchronizer tokens, double-submit cookies, SameSite attributes, and origin validation. Use this skill when you need to analyze your application's security posture against CSRF attacks or when asked to \"validate csrf\", \"check for csrf vulnerabilities\", or \"test csrf protection\".\n---\n\n## Overview\n\nThis skill empowers Claude to analyze web applications for CSRF vulnerabilities. It assesses the effectiveness of implemented CSRF protection mechanisms, providing insights into potential weaknesses and recommendations for remediation.\n\n## How It Works\n\n1. **Analyze Endpoints**: The plugin examines application endpoints to identify those lacking CSRF protection.\n2. **Assess Protection Mechanisms**: It validates the implementation of CSRF protection mechanisms, including token validation, double-submit cookies, SameSite attributes, and origin validation.\n3. **Generate Report**: A detailed report is generated, highlighting vulnerable endpoints, potential attack scenarios, and recommended fixes.\n\n## When to Use This Skill\n\nThis skill activates when you need to:\n- Validate existing CSRF protection measures.\n- Identify CSRF vulnerabilities in a web application.\n- Assess the risk associated with unprotected endpoints.\n- Generate a report outlining CSRF vulnerabilities and recommended fixes.\n\n## Examples\n\n### Example 1: Identifying Unprotected API Endpoints\n\nUser request: \"validate csrf\"\n\nThe skill will:\n1. Analyze the application's API endpoints.\n2. Identify endpoints lacking CSRF protection, such as those handling sensitive data modifications.\n3. Generate a report outlining vulnerable endpoints and potential attack vectors.\n\n### Example 2: Checking SameSite Cookie Attributes\n\nUser request: \"Check for csrf vulnerabilities in my application\"\n\nThe skill will:\n1. Analyze the application's cookie settings.\n2. Verify that SameSite attributes are properly configured to mitigate CSRF attacks.\n3. Report any cookies lacking the SameSite attribute or using an insecure setting.\n\n## Best Practices\n\n- **Regular Validation**: Regularly validate CSRF protection mechanisms as part of the development lifecycle.\n- **Comprehensive Coverage**: Ensure all state-changing operations are protected against CSRF attacks.\n- **Secure Configuration**: Use secure configurations for CSRF protection mechanisms, such as strong token generation and proper SameSite attribute settings.\n\n## Integration\n\nThis skill can be used in conjunction with other security plugins to provide a comprehensive security assessment of web applications. For example, it can be combined with a vulnerability scanner to identify other potential vulnerabilities in addition to CSRF weaknesses.\n","## Overview\n\nThis skill empowers Claude to analyze web applications for CSRF vulnerabilities. It assesses the effectiveness of implemented CSRF protection mechanisms, providing insights into potential weaknesses and recommendations for remediation.\n\n## How It Works\n\n1. **Analyze Endpoints**: The plugin examines application endpoints to identify those lacking CSRF protection.\n2. **Assess Protection Mechanisms**: It validates the implementation of CSRF protection mechanisms, including token validation, double-submit cookies, SameSite attributes, and origin validation.\n3. **Generate Report**: A detailed report is generated, highlighting vulnerable endpoints, potential attack scenarios, and recommended fixes.\n\n## When to Use This Skill\n\nThis skill activates when you need to:\n- Validate existing CSRF protection measures.\n- Identify CSRF vulnerabilities in a web application.\n- Assess the risk associated with unprotected endpoints.\n- Generate a report outlining CSRF vulnerabilities and recommended fixes.\n\n## Examples\n\n### Example 1: Identifying Unprotected API Endpoints\n\nUser request: \"validate csrf\"\n\nThe skill will:\n1. Analyze the application's API endpoints.\n2. Identify endpoints lacking CSRF protection, such as those handling sensitive data modifications.\n3. Generate a report outlining vulnerable endpoints and potential attack vectors.\n\n### Example 2: Checking SameSite Cookie Attributes\n\nUser request: \"Check for csrf vulnerabilities in my application\"\n\nThe skill will:\n1. Analyze the application's cookie settings.\n2. Verify that SameSite attributes are properly configured to mitigate CSRF attacks.\n3. Report any cookies lacking the SameSite attribute or using an insecure setting.\n\n## Best Practices\n\n- **Regular Validation**: Regularly validate CSRF protection mechanisms as part of the development lifecycle.\n- **Comprehensive Coverage**: Ensure all state-changing operations are protected against CSRF attacks.\n- **Secure Configuration**: Use secure configurations for CSRF protection mechanisms, such as strong token generation and proper SameSite attribute settings.\n\n## Integration\n\nThis skill can be used in conjunction with other security plugins to provide a comprehensive security assessment of web applications. For example, it can be combined with a vulnerability scanner to identify other potential vulnerabilities in addition to CSRF weaknesses.\n",{"name":5,"description":7},"master","be156301b65e301887f327d08190ed4f17ba08d2","docs\u002Fnot-mcp-related\u002Fclaude-skills\u002Ftemp\u002Fcode-plugins\u002Fplugins\u002Fsecurity\u002Fcsrf-protection-validator\u002Fskills\u002Fcsrf-protection-validator",0,"https:\u002F\u002Fgithub.com\u002Fsandraschi\u002Fdocumentation-mcp","https:\u002F\u002Fgithub.com\u002Fsandraschi","2026-11-13 15:00:21",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add sandraschi\u002Fdocumentation-mcp --skill validating-csrf-protection",{"tool":62,"command":63},"bunx","bunx skills add sandraschi\u002Fdocumentation-mcp --skill validating-csrf-protection",{"tool":65,"command":66},"pnpm","pnpm dlx skills add sandraschi\u002Fdocumentation-mcp --skill validating-csrf-protection","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fsandraschi\u002Fdocumentation-mcp\u002Fblob\u002Fmaster\u002Fdocs\u002Fnot-mcp-related\u002Fclaude-skills\u002Ftemp\u002Fcode-plugins\u002Fplugins\u002Fsecurity\u002Fcsrf-protection-validator\u002Fskills\u002Fcsrf-protection-validator\u002FSKILL.md",true,[70,76,82],{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"assets\u002FREADME.md","ASSET","资产文件",216,"https:\u002F\u002Fgithub.com\u002Fsandraschi\u002Fdocumentation-mcp\u002Fblob\u002Fmaster\u002Fdocs\u002Fnot-mcp-related\u002Fclaude-skills\u002Ftemp\u002Fcode-plugins\u002Fplugins\u002Fsecurity\u002Fcsrf-protection-validator\u002Fskills\u002Fcsrf-protection-validator\u002Fassets\u002FREADME.md",{"path":77,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":80,"sourceHtmlUrl":81},"references\u002FREADME.md","REFERENCE","参考文档",397,"https:\u002F\u002Fgithub.com\u002Fsandraschi\u002Fdocumentation-mcp\u002Fblob\u002Fmaster\u002Fdocs\u002Fnot-mcp-related\u002Fclaude-skills\u002Ftemp\u002Fcode-plugins\u002Fplugins\u002Fsecurity\u002Fcsrf-protection-validator\u002Fskills\u002Fcsrf-protection-validator\u002Freferences\u002FREADME.md",{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"scripts\u002FREADME.md","SCRIPT","脚本",233,"https:\u002F\u002Fgithub.com\u002Fsandraschi\u002Fdocumentation-mcp\u002Fblob\u002Fmaster\u002Fdocs\u002Fnot-mcp-related\u002Fclaude-skills\u002Ftemp\u002Fcode-plugins\u002Fplugins\u002Fsecurity\u002Fcsrf-protection-validator\u002Fskills\u002Fcsrf-protection-validator\u002Fscripts\u002FREADME.md",[89,111,138,148,173,198],{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":99,"publishedAt":44},"01M6PFAWAHEJJCKKVNXEWNK87W","Docs Research","Use MCP Central Docs server to search, ask, and retrieve documentation (FastMCP, standards, packaging).","https:\u002F\u002Fgithub.com\u002Fsandraschi\u002Fdocumentation-mcp\u002Fblob\u002Fmaster\u002Fsrc\u002Fdocs_mcp\u002Fskills\u002Fdocs-research\u002FSKILL.md",[95,98],{"categoryNo":96,"categoryName":97,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[100,101,102,103,38,104,105,106,107,108,109,110],"docs research","docs","research","standards","packaging","ask","server","search","fastmcp","documentation","MCP",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":117,"publishedAt":44},"01M6PFAN4DAENMY574Q7Q3CB3H","wrappee-drift","Read-only, single-repo audit of a repo's tool coverage against the software it wraps (its current real API\u002Fdocs, not training-data memory) and against comparable\u002Fcompeting wrappers. Trigger when the user says \"wrappee drift\" followed by a repo name, \"capability audit\" followed by a repo name, or asks whether a repo is missing features the wrapped software or a competitor now has. Always scoped to one named repo per invocation -- never trigger this fleet-wide or unprompted; that is explicitly against the SOP. Do NOT trigger for internal fleet-standard compliance (that is drift-scan) or strategic worth\u002Farchive decisions (that is quality-check) -- this is specifically about the gap between the repo's tool list and the wrapped software's\u002Fcompetitors' actual current capabilities.","https:\u002F\u002Fgithub.com\u002Fsandraschi\u002Fdocumentation-mcp\u002Fblob\u002Fmaster\u002Fdocs\u002Fskills\u002Fwrappee-drift\u002FSKILL.md",[],[118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137],"drift","wrappee drift","api","data","audit","capabilities","training","memory","features","repo audit","competitors","fleet","now","software","tool list","only","never","coverage","list","read",{"skillNo":139,"name":140,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":147,"publishedAt":44},"01M6PFADA3X031SK3W3T6X0N6H","modules","https:\u002F\u002Fgithub.com\u002Fsandraschi\u002Fdocumentation-mcp\u002Fblob\u002Fmaster\u002Fdocs\u002Fskills\u002Fwindsurf-mcp-standards\u002Fmodules\u002FSKILL.md",[143,146],{"categoryNo":144,"categoryName":145,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[140],{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":158,"publishedAt":44},"01M6PFA8YA029N68TW0X31FB1W","mcp-standards","Use when developing MCP servers to access comprehensive standards for scaffolding, packaging, sampling, documentation, testing, error handling, monitoring, and CI\u002FCD workflows.","https:\u002F\u002Fgithub.com\u002Fsandraschi\u002Fdocumentation-mcp\u002Fblob\u002Fmaster\u002Fdocs\u002Fskills\u002Fwindsurf-mcp-standards\u002FSKILL.md",[154,157],{"categoryNo":155,"categoryName":156,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[159,110,103,38,160,161,162,163,164,165,30,166,167,168,169,170,109,171,172,104],"mcp standards","monitoring","sampling","scaffolding","servers","cd","error","CI\u002FCD","access","ci","mcp servers","error handling","workflows","testing",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":181,"publishedAt":44},"01M6PFA1XX344WX57B0DJZY94Q","webapp-cua-test","Run the pre-Tauri CUA click-through test (real browser, dev stack, OCR \"Connected\" wait, sidebar nav walk) for a fleet MCP server repo under D:\\Dev\\repos. Trigger when the user says \"cua webapp test\" or \"webapp clickthrough\" followed by a repo name, asks for an e2e click-through of a webapp, or asks whether a webapp boots and connects in a real browser. Not for the installed NSIS app (that is the nsis-build skill \u002F cua-nsis-test) and not for DOM assertions (Playwright), and not for hunting fake data or dead buttons (fakefind).","https:\u002F\u002Fgithub.com\u002Fsandraschi\u002Fdocumentation-mcp\u002Fblob\u002Fmaster\u002Fdocs\u002Fskills\u002Fwebapp-cua-test\u002FSKILL.md",[179,180],{"categoryNo":155,"categoryName":156,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[182,37,183,184,185,110,186,187,188,30,189,190,191,192,193,194,195,196,106,197],"webapp","webapp cua test","playwright","mcp server","dev","dom","assertions","trigger","click","app","tauri","repo","stack","e2e","ocr","browser",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":205,"publishedAt":44},"01M6PF9WYF6NWJR7WVN38TT0WH","ship","Final release gate for a fleet MCP server repo under D:\\Dev\\repos -- run all quality gates, build the release artifact, verify it, commit, push, and cut a GitHub release. Trigger this whenever the user says \"ship it\", \"ship\" followed by a repo name, \"release\" followed by a repo name, or asks to finalize and publish work that's already been done in a repo. This is the terminal step after assfix\u002Fnsis-build, not a substitute for them -- if the repo hasn't been assessed recently, say so before shipping rather than shipping blind.","https:\u002F\u002Fgithub.com\u002Fsandraschi\u002Fdocumentation-mcp\u002Fblob\u002Fmaster\u002Fdocs\u002Fskills\u002Fship\u002FSKILL.md",[204],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[200,193,30,189,206,207,208,209,210,211,212,106,213,186,214,215,216,185,217,110],"gates","ship it","artifact","done","say","work","publish","push","shipping","quality gates","commit","github"]