How do I install the Web Clickjacking skill?

Run npx skillmds@latest add noorqureshi/web-clickjacking in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Web Clickjacking safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Web Clickjacking?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Web Clickjacking free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Web Clickjacking?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Web Clickjacking by noorqureshi — Agent Skill

Name: Web Clickjacking
Author: NoorQureshi

Web Clickjacking

Clickjacking / UI redress — frame a target so a victim's clicks hit hidden actions. Load when a page allows framing (no X-Frame-Options / frame-ancestors), on state-changing one-click actions, or "clickjacking". Signals: missing framebusting headers, sensitive buttons, OAuth consent, account settings.

NoorQureshi 88dfaf2 2.1 KB Updated Sep 17, 2026

File contents

Clickjacking (UI redress)

When it applies

A sensitive, state-changing page can be embedded in an <iframe> on an attacker site, and the action needs only clicks (no CSRF token / re-auth). The attacker overlays their own UI so the victim clicks the framed action unknowingly.

Why it works

Without X-Frame-Options: DENY/SAMEORIGIN or CSP frame-ancestors, the browser lets any site frame the page. Making the frame transparent and positioning it under a decoy button turns the victim's clicks into actions on the target in their authenticated session.

Method

Check framability: load the target in <iframe src="https://target/…">; if it renders (no framebusting), it's frameable. Inspect for missing X-Frame-Options / frame-ancestors.
Find a worthwhile action: one-click state change — delete account, change email, authorize OAuth, transfer, enable a setting.
Build the PoC: transparent iframe (opacity:0) over a decoy ("Click to win"), aligned so the victim's click lands on the target's button. Multi-step → chain frames/drag (classic UI redress).
Assess impact honestly — clickjacking on a trivial action is low; on ATO/authorization it matters.

Gotchas

SameSite=Lax/Strict cookies can break framed authenticated actions — verify the action still fires framed.
Modern browsers + CSP frame-ancestors usually block it; the finding is the missing protection + a real action.
Don't over-claim: needs victim interaction and a meaningful action to be more than informational.

Verify success

A working PoC page where a normal-looking click performs the sensitive action on the target in the victim's session (screen-record the overlay).

References

PortSwigger clickjacking labs; OWASP clickjacking defense cheat sheet.

---name: web-clickjackingdescription: Clickjacking / UI redress — frame a target so a victim's clicks hit hidden actions. Load when a page allows framing (no X-Frame-Options / frame-ancestors), on state-changing one-click actions, or "clickjacking". Signals: missing framebusting headers, sensitive buttons, OAuth consent, account settings.---# Clickjacking (UI redress)## When it appliesA sensitive, state-changing page can be embedded in an `<iframe>` on an attacker site, and theaction needs only clicks (no CSRF token / re-auth). The attacker overlays their own UI so thevictim clicks the framed action unknowingly.## Why it worksWithout `X-Frame-Options: DENY/SAMEORIGIN` or CSP `frame-ancestors`, the browser lets any siteframe the page. Making the frame transparent and positioning it under a decoy button turns thevictim's clicks into actions on the target in their authenticated session.## Method1. **Check framability**: load the target in `<iframe src="https://target/…">`; if it renders (no framebusting), it's frameable. Inspect for missing `X-Frame-Options` / `frame-ancestors`.2. **Find a worthwhile action**: one-click state change — delete account, change email, authorize OAuth, transfer, enable a setting.3. **Build the PoC**: transparent iframe (`opacity:0`) over a decoy ("Click to win"), aligned so the victim's click lands on the target's button. Multi-step → chain frames/drag (classic UI redress).4. **Assess impact** honestly — clickjacking on a trivial action is low; on ATO/authorization it matters.## Gotchas- `SameSite=Lax/Strict` cookies can break framed authenticated actions — verify the action still fires framed.- Modern browsers + CSP `frame-ancestors` usually block it; the finding is the *missing* protection + a real action.- Don't over-claim: needs victim interaction and a meaningful action to be more than informational.## Verify successA working PoC page where a normal-looking click performs the sensitive action on the target in thevictim's session (screen-record the overlay).## ReferencesPortSwigger clickjacking labs; OWASP clickjacking defense cheat sheet.

Frequently asked questions