Does it check for CSRF protection?

Yes, it reviews SameSite cookie attributes and checks for token-based CSRF protections as part of its session hijacking and cookie security analysis.

What frameworks does this skill support?

It includes specific patterns for popular frameworks like Express.js, Django, and Spring, but it also applies general security principles to analyze custom session implementations.

Where are the security reports saved?

The skill generates a comprehensive Markdown report saved to the {baseDir}/security-reports/ directory for your team to review and track.

Can it fix vulnerabilities automatically?

Yes, it can provide specific remediation code snippets and utilize Claude's editing capabilities to apply fixes to your configuration files and authentication logic.

Session Security Checker

Name: Session Security Checker
Author: BbgnsurfTech

byBbgnsurfTech

•

安全与测试

Analyzes web application session management to identify and remediate security vulnerabilities like session fixation and weak cookie configurations.

关于

This skill provides a comprehensive security audit for web application session handling by scanning source code for critical vulnerabilities. It automatically detects insecure session ID generation, missing cookie security flags (HttpOnly, Secure, SameSite), session fixation risks, and improper timeout configurations across various frameworks like Express, Django, and Spring. By generating detailed remediation reports with actionable code examples, it helps developers harden their authentication layers and maintain compliance with industry standards like OWASP and PCI-DSS.

主要功能

Generation of detailed Markdown security reports with remediation code
Evaluation of session ID entropy and randomness patterns
Automated vulnerability detection for session fixation and hijacking
Review of idle and absolute session timeout configurations
3 GitHub stars
Deep analysis of cookie security attributes including HttpOnly and SameSite

使用场景

Performing pre-deployment security audits of web authentication modules
Validating codebase compliance with OWASP session management standards
Identifying and fixing weak session configurations in legacy applications

关于

主要功能

Generation of detailed Markdown security reports with remediation code
Evaluation of session ID entropy and randomness patterns
Automated vulnerability detection for session fixation and hijacking
Review of idle and absolute session timeout configurations
3 GitHub stars
Deep analysis of cookie security attributes including HttpOnly and SameSite

使用场景

Performing pre-deployment security audits of web authentication modules
Validating codebase compliance with OWASP session management standards
Identifying and fixing weak session configurations in legacy applications