Skip to content
appsgit

Hunt Csrf

Hunt Csrf is an agent skill (a SKILL.md file) from elementalsouls/Claude-BugHunter. Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET. It works with Claude Code, Codex and OpenCode and has 5,306 GitHub stars across a repository of 4 listed skills.

github.com/elementalsouls/Claude-BugHunter/skills/hunt-csrf (opens in a new tab)

Data as of from the GitHub API; description from the skill's SKILL.md. Report an error

View on GitHub (opens in a new tab)

Add this skill

Claude

This repository is a Claude Code plugin marketplace. In Claude Code:

/plugin marketplace add elementalsouls/Claude-BugHunter
/plugin install claude-bughunter@elementalsouls

In the Claude apps, zip the hunt-csrf folder and upload it under Customize > Skills > + > Upload a skill (code execution must be on).

ChatGPT / Codex

Codex reads skills from .agents/skills/ in a repo or ~/.agents/skills/ for every project:

git clone --depth 1 https://github.com/elementalsouls/Claude-BugHunter.git
cp -r Claude-BugHunter/skills/hunt-csrf .agents/skills/hunt-csrf   # repo; ~/.agents/skills for all projects

Standalone skills also load in the ChatGPT desktop app.

Cursor

Cursor loads skills from .cursor/skills/ (or ~/.cursor/skills/) and also reads .claude/skills/:

git clone --depth 1 https://github.com/elementalsouls/Claude-BugHunter.git
cp -r Claude-BugHunter/skills/hunt-csrf .cursor/skills/hunt-csrf   # project; ~/.cursor/skills for all projects

Source (checked Oct 7, 2026): code.claude.com/docs/en/skills (opens in a new tab), code.claude.com/docs/en/plugin-marketplaces (opens in a new tab), support.claude.com/en/articles/12512180-using-skills-in-claude (opens in a new tab), learn.chatgpt.com/docs/build-skills (opens in a new tab), cursor.com/docs/context/skills (opens in a new tab)

What this skill does

Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET (GitLab $3,370), framework-wide CSRF middleware disabled (Stripe Dashboard $5,000), path-traversal CSRF-token bypass (GitHub Enterprise CVE-2022-23732 $10k), Origin-omission bypass (TikTok $2,500), OAuth-state null-byte (Streamlabs), WebSocket CSRF / CSWSH (Coda), default-SameSite email-change → ATO…

When it triggers

  • Use when hunting modern CSRF — heavy emphasis on chain-to-ATO patterns.

More skills in elementalsouls/Claude-BugHunter

4 skills are listed from this repository.

Similar skills

More security skills

All Security

FAQ

Hunt Csrf FAQ

Still curious? Email info@appsgit.com.

How do I install the Hunt Csrf skill?

In Claude Code, run /plugin marketplace add elementalsouls/Claude-BugHunter and then /plugin install claude-bughunter@elementalsouls. For Codex or Cursor, copy the hunt-csrf folder into .agents/skills/ or .cursor/skills/.

Is the Hunt Csrf skill free?

Yes. The repository is open source under the MIT license.

Is Hunt Csrf maintained?

The repository's most recent commit was on Oct 25, 2026. Its latest release is v2.1. appsgit only lists skills from repositories with a commit in the last six months.