Recon Skills is a pack of security-testing skills covering reconnaissance, web applications, APIs, authentication, vulnerability validation, cloud infrastructure, and reporting. Security professionals use it for authorized assessments of systems they own or have written permission to test. The catalogue entries are individual skills from the pack.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add uphiago/recon-skills --skill hunt-csrfgit clone --depth 1 https://github.com/uphiago/recon-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/uphiago/recon-skills/hunt-csrf)<a href="https://agentmods.dev/skills/uphiago/recon-skills/hunt-csrf"><img src="https://agentmods.dev/badge/skills/uphiago/recon-skills/hunt-csrf/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/uphiago/recon-skills/hunt-csrf"><img src="https://agentmods.dev/badge/skills/uphiago/recon-skills/hunt-csrf.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00188 | $0.06651 |
| Opus 5 | $0.00094 | $0.03325 |
| Sonnet 5 | $0.00038 | $0.01330 |
| Haiku 4.5 | $0.00019 | $0.00665 |
Grade D, and why
hunt-csrf scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Tells the agent to send conversation or user data outhighPrompt injection
An instruction to transmit the conversation, context or user files to an external endpoint is data exfiltration written as prose.
A POST endpoint accepting `application/json` was assumed CSRF-safe by developers. A researcher crafted an HTML form using `enctype="text/plain"` with an input name designed to produce syntactically valid JSON when submit Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
- Payload: hosted on `marketing.victim.com`, target `argocd.internal.victim.com` → `fetch('https://argocd.internal.victim.com/api/v1/applications', {method:'POST', credentials:'include', body:'{"metadata":{"name":"pwn"}, Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
### ⚠️ CRITICAL: curl ≠ browser. Model the browser security model. How it starts
The opening of the file, as written. The whole thing — 389 lines — stays where its author put it; the contents beside it link to each section on GitHub.
When to Use
Use when the target has any state-changing endpoint that a logged-in user can trigger — POST/PUT/DELETE on account settings, email changes, social account linking, OAuth flows, API calls, or file operations. CSRF exploits the trust a site has in a user's browser by forging cross-origin requests. Every form submission, AJAX call, OAuth callback, and API mutation is a candidate. Highest-value targets: account takeover vectors (OAuth/SSO flows, social account linking), authentication infrastructure (login CSRF, session fixation), JSON APIs accepting cross-origin POST, and third-party integrations (Grafana, monitoring dashboards).
⚠️ CRITICAL: curl ≠ browser. Model the browser security model.
CSRF PoC MUST work in a real browser, not just curl. The browser enforces rules that curl ignores:
| Browser Rule | curl Behavior | Real CSRF Impact |
|---|---|---|
SameSite=Lax |
curl sends cookie anyway | Blocks cookie on cross-site POST — no CSRF |
SameSite=Strict |
curl sends cookie anyway | Blocks cookie on all cross-site requests — no CSRF |
| CORS preflight | curl skips OPTIONS | Browser blocks if Content-Type: application/json |
Sec-Fetch-Site: cross-site |
curl doesn't send | Server can reject cross-site requests via this header |
CSRF verification checklist:
- ✅ Endpoint changes state (POST/PUT/DELETE)
- ✅ Cookie has
SameSite=NoneORSameSite=Laxwith GET-based action - ✅ No custom CSRF token/header required
- ✅ PoC works from a different origin in a real browser
If step 2 fails (SameSite=Lax on POST endpoint) → NOT exploitable CSRF via curl alone. SameSite=Lax allows cookies on top-level navigation GET, not cross-site POST. A curl POST succeeding with the cookie is a false positive — the browser would block it.
CSRF Middleware Protection Bypass:
- Many modern web frameworks (for example, those with CSRF protection enabled by default) reject state-changing requests such as POST, PUT, or DELETE with a
403 Forbiddenresponse when the CSRF token is missing or invalid. - In some applications, if the
PATCHmethod is not covered by the same CSRF middleware or is handled differently, it may be possible to perform the same state-changing action using PATCH instead. This can result in a CSRF protection bypass if the server accepts the request without validating a CSRF token.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 389 lines · 188 tokens per session scan D f4a096fbb494
hunt-csrf is a skill published in the GitHub repository uphiago/recon-skills (1,254 stars, last pushed 10d ago), licensed MIT. It adds 188 tokens to every session and 6,651 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it D with 3 findings (tells the agent to send conversation or user data out, sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
web2-vuln-classes
Complete reference for 26 web2 bug classes with root causes, detection patterns, bypass tables, exploit techniques, and real paid examples. Covers IDOR, auth bypass, XSS, SSRF (11 IP bypass techniques), SQLi, business logic, race conditions, OAuth/OIDC, file upload (10 bypass techniques), GraphQL, LLM/AI (ASI01-ASI10…
auditing-gcp-iam-permissions
Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.
detecting-compromised-cloud-credentials
Detecting compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible travel patterns, unauthorized resource provisioning, and credential abuse indicators using GuardDuty, Defender for Identity, and SCC Event Threat Detection.
implementing-aws-config-rules-for-compliance
Implementing AWS Config rules for continuous compliance monitoring of AWS resources, deploying managed and custom rules aligned to CIS and PCI DSS frameworks, configuring automatic remediation with SSM Automation, and aggregating compliance data across accounts.
implementing-cloud-dlp-for-data-protection
Implementing Cloud Data Loss Prevention (DLP) using Amazon Macie, Azure Information Protection, and Google Cloud DLP API to discover, classify, and protect sensitive data across cloud storage, databases, and data pipelines.
implementing-cloud-trail-log-analysis
Implementing AWS CloudTrail log analysis for security monitoring, threat detection, and forensic investigation using Athena, CloudWatch Logs Insights, and SIEM integration to identify unauthorized access, privilege escalation, and suspicious API activity.