How do I install the Torusguard Web Validate skill?

Run npx skillmds@latest add githubmofo/torusguard-web-validate-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Torusguard Web Validate safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Torusguard Web Validate?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Torusguard Web Validate free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Torusguard Web Validate?

githubmofo (@githubmofo) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Torusguard Web Validate by githubmofo

Name: Torusguard Web Validate
Author: githubmofo

File contents

TorusGuard Web Validate — Bounded HTTP Probing & Session Capture

Objective

Safely probe live web applications within authorized scope, injecting transparent audit headers, verifying security headers and cookies, redacting sensitive tokens, and recording deterministic replay traces.

Authorization Gate Check

Before dispatching any HTTP request:

Verify .torusguard/config/scope.json exists and contains target URL.
Confirm current timestamp is prior to expires_at TTL.
Assert target is local or non-production staging.

Safety Gate

All requests pass through .torusguard/scripts/safety_gate.py:

Auto-Allowed: Read-only GET, HEAD, OPTIONS on non-sensitive paths.
Approval Required: Requests touching auth, sessions, or parameters.
Manual Only: Any destructive method (DELETE, DROP) is strictly blocked.

Execution Steps

Gate Check: Validate scope in scope.json and query safety_gate.py.
Handle Automation Failure: If automated web validation scripts fail, YOU must manually construct the HTTP requests (using curl or fetch) and inspect the responses.
Inject Audit Header: Attach X-TorusGuard-AuthID: <auth_id> to all outbound requests.
Dispatch Bounded Probe: Send single non-destructive HTTP request.
Validate Security Headers: Check for CSP, HSTS, X-Content-Type-Options, and CORS configurations.
Audit Cookie Flags: Verify HttpOnly, Secure, and SameSite on session cookies.
Capture Replay Trace: Save sanitized trace in .torusguard/runs/<run_id>/requests.json.

Credential Redaction

All Bearer tokens, cookies, passwords, and API keys are redacted prior to disk serialization (Bearer [REDACTED]).

Safety Constraints

Max 50 requests per validation session.
Never test unauthorized domains or third-party APIs.
Zero state-changing destructive operations.

Output Format

🌐 [TorusGuard] Web Validation Completed (AI Assisted)
- Target: <Host URL> | Endpoints Tested: <Count>
- Header Posture: <CSP/HSTS Status> | Cookies: <Flags Status>
- Replay Trace: `.torusguard/runs/<run_id>/requests.json`
Next: Run `/torusguard exploit-check` to confirm exploitability of candidate flaws.

---name: torusguard-web-validate-2description: Execute authorized HTTP probing against local/staging web applications — session capture, transparent audit headers, and secret redaction.---# TorusGuard Web Validate — Bounded HTTP Probing & Session Capture## ObjectiveSafely probe live web applications within authorized scope, injecting transparent audit headers, verifying security headers and cookies, redacting sensitive tokens, and recording deterministic replay traces.---## Authorization Gate CheckBefore dispatching any HTTP request:1. Verify `.torusguard/config/scope.json` exists and contains target URL.2. Confirm current timestamp is prior to `expires_at` TTL.3. Assert target is local or non-production staging.---## Safety GateAll requests pass through `.torusguard/scripts/safety_gate.py`:- `Auto-Allowed`: Read-only `GET`, `HEAD`, `OPTIONS` on non-sensitive paths.- `Approval Required`: Requests touching auth, sessions, or parameters.- `Manual Only`: Any destructive method (`DELETE`, `DROP`) is strictly blocked.---## Execution Steps1. **Gate Check:** Validate scope in `scope.json` and query `safety_gate.py`.2. **Handle Automation Failure:** If automated web validation scripts fail, YOU must manually construct the HTTP requests (using `curl` or `fetch`) and inspect the responses.3. **Inject Audit Header:** Attach `X-TorusGuard-AuthID: <auth_id>` to all outbound requests.4. **Dispatch Bounded Probe:** Send single non-destructive HTTP request.5. **Validate Security Headers:** Check for CSP, HSTS, X-Content-Type-Options, and CORS configurations.6. **Audit Cookie Flags:** Verify `HttpOnly`, `Secure`, and `SameSite` on session cookies.7. **Capture Replay Trace:** Save sanitized trace in `.torusguard/runs/<run_id>/requests.json`.---## Credential RedactionAll Bearer tokens, cookies, passwords, and API keys are redacted prior to disk serialization (`Bearer [REDACTED]`).---## Safety Constraints- Max 50 requests per validation session.- Never test unauthorized domains or third-party APIs.- Zero state-changing destructive operations.---## Output Format```markdown🌐 [TorusGuard] Web Validation Completed (AI Assisted)- Target: <Host URL> | Endpoints Tested: <Count>- Header Posture: <CSP/HSTS Status> | Cookies: <Flags Status>- Replay Trace: `.torusguard/runs/<run_id>/requests.json`Next: Run `/torusguard exploit-check` to confirm exploitability of candidate flaws.```

Frequently asked questions

Torusguard Web Validate