Skill UI

An expert skill dedicated to building secure, robust frontend applications. It specializes in preventing client-side vulnerabilities such as XSS and clickjacking. Core capabilities include safe DOM manipulation, implementing Content Security Policy (CSP), advanced input sanitization (allowlisting), and securing complex interactions like secure redirects and session management.

This skill guides authorized security professionals through testing web applications for clickjacking vulnerabilities. It involves checking frame embedding controls (like X-Frame-Options and CSP) and crafting complex proof-of-concept overlays to see if users can be tricked into performing unintended sensitive actions, such as deleting accounts or transferring funds.

This guide provides a comprehensive methodology for auditing essential HTTP security headers, including CSP, HSTS, X-Frame-Options, and Referrer-Policy. It helps identify missing or improperly configured browser-level protections, crucial for mitigating vulnerabilities like XSS, clickjacking, and mixed content issues, ensuring compliance with standards like PCI DSS and SOC 2.

A comprehensive playbook for identifying and exploiting clickjacking vulnerabilities (UI redress). Learn how to test if target pages can be framed, bypass security headers like X-Frame-Options and CSP frame-ancestors, and execute high-impact actions through invisible iframes. This guide covers single-click, multi-step, and drag-and-drop attack vectors, applicable to sensitive endpoints like account deletion or admin panels.

Expert in secure frontend coding practices specializing in XSS prevention, output sanitization, and client-side security patterns. Provides guidance on CSP configuration, safe DOM manipulation, input validation, clickjacking protection, and secure redirects.

This skill focuses on identifying clickjacking vulnerabilities where malicious sites overlay transparent iframes over legitimate pages to trick users into unintended actions. It involves checking security headers like X-Frame-Options and CSP, verifying if sensitive actions can be triggered via framing, and ensuring proper authorization before testing. It is strictly for authorized security assessments and bug bounty programs.