# Torusguard Web Validate

> Execute authorized HTTP probing against local/staging web applications — session capture, transparent audit headers, and secret redaction.

- Skill: `githubmofo/torusguard-web-validate` (Agent Skill)
- Install (CLI): `npx skillmds@latest add githubmofo/torusguard-web-validate`
- Raw SKILL.md: https://api.skillmd.com/api/skills/githubmofo/torusguard-web-validate/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: githubmofo (https://skillmd.com/u/githubmofo)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/githubmofo/torusguard-web-validate

---


# TorusGuard Web Validate — Bounded HTTP Probing & Session Capture

## Objective
Safely probe live web applications within authorized scope, injecting transparent audit headers, verifying security headers and cookies, redacting sensitive tokens, and recording deterministic replay traces.

---

## Authorization Gate Check
Before dispatching any HTTP request:
1. Verify `.torusguard/config/scope.json` exists and contains target URL.
2. Confirm current timestamp is prior to `expires_at` TTL.
3. Assert target is local or non-production staging.

---

## Safety Gate
All requests pass through `.torusguard/scripts/safety_gate.py`:
- `Auto-Allowed`: Read-only `GET`, `HEAD`, `OPTIONS` on non-sensitive paths.
- `Approval Required`: Requests touching auth, sessions, or parameters.
- `Manual Only`: Any destructive method (`DELETE`, `DROP`) is strictly blocked.

---

## Execution Steps

1. **Gate Check:** Validate scope in `scope.json` and query `safety_gate.py`.
2. **Handle Automation Failure:** If automated web validation scripts fail, YOU must manually construct the HTTP requests (using `curl` or `fetch`) and inspect the responses.
3. **Inject Audit Header:** Attach `X-TorusGuard-AuthID: <auth_id>` to all outbound requests.
4. **Dispatch Bounded Probe:** Send single non-destructive HTTP request.
5. **Validate Security Headers:** Check for CSP, HSTS, X-Content-Type-Options, and CORS configurations.
6. **Audit Cookie Flags:** Verify `HttpOnly`, `Secure`, and `SameSite` on session cookies.
7. **Capture Replay Trace:** Save sanitized trace in `.torusguard/runs/<run_id>/requests.json`.

---

## Credential Redaction
All Bearer tokens, cookies, passwords, and API keys are redacted prior to disk serialization (`Bearer [REDACTED]`).

---

## Safety Constraints
- Max 50 requests per validation session.
- Never test unauthorized domains or third-party APIs.
- Zero state-changing destructive operations.

---

## Output Format
```markdown
🌐 [TorusGuard] Web Validation Completed (AI Assisted)
- Target: <Host URL> | Endpoints Tested: <Count>
- Header Posture: <CSP/HSTS Status> | Cookies: <Flags Status>
- Replay Trace: `.torusguard/runs/<run_id>/requests.json`
Next: Run `/torusguard exploit-check` to confirm exploitability of candidate flaws.
```