csrf-cross-site-request-forgery

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs reading CSRF tokens from the DOM/HTTP responses and then inserting those tokens verbatim into requests/headers (e.g., data.csrf_token, token), which requires handling secret/session token values directly and poses a high exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document is an explicit offensive CSRF attack playbook with actionable PoCs for account takeover, privilege escalation, webshell upload, token theft, and OAuth hijacking—clearly malicious in intent.