skills.rest
celikgo
celikgoCOMMUNITY
Explore all skills by this author →
𝕏@skyhunstGitHub

auditing-web-security

Audits a loaded web page for CSP weaknesses, mixed content, and missing cookie flags.

Updated Apr 11, 2026
Search Tags:#CSP#security audit#httponly#mixed content#samesite#cookie flags#webmobai
One-click install
npx skills add https://github.com/celikgo/webmobai --skill auditing-web-security-celikgo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auditing-web-security
Source: https://github.com/celikgo/webmobai/tree/main/.claude/skills/auditing-web-security
Command: npx skills add https://github.com/celikgo/webmobai --skill auditing-web-security-celikgo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Manually checking a page's security headers, Content-Security-Policy, and cookie attributes is tedious and error-prone, and teams often ship pages with missing Secure/HttpOnly/SameSite flags or weak CSP directives without noticing. This Skill runs a fast, read-only hygiene scan of any loaded page and reports findings grouped by severity. ## Core Features & Use Cases - CSP Analysis: Detects missing Content-Security-Policy, absent default-src/script-src, and unsafe-inline or unsafe-eval directives, graded by severity. - Mixed Content & HTTPS Checks: Flags pages served over plain HTTP and http:// subresources loaded on HTTPS pages. - Cookie Flag Audit: Reports cookies missing Secure, HttpOnly, or strong SameSite attributes, escalating session/auth cookies to high severity — without ever exposing cookie values. - Use Case: After logging into your staging dashboard, ask for a security audit to confirm the session cookie is HttpOnly and Secure, the CSP does not allow unsafe-inline scripts, and no mixed content is loaded — then log the findings as test results. ## Quick Start Run a security hygiene audit on https://app.example.com/dashboard and report the CSP, mixed content, and cookie flag findings grouped by severity.

Frequently Asked Questions about auditing-web-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check a web page's security headers and cookie flags?▼

Launch a browser, navigate to the target page, and run the security audit tool, which inspects the Content-Security-Policy, mixed content, and cookie attributes. Findings are returned grouped by severity as high or medium, with cookie names reported but never values.

How to audit a page that requires login?▼

Capture an authenticated session once with webmobai_save_storage_state, then launch the browser with storage_state_path to replay it. Audit a freshly logged-in session when checking server-set cookie flags, since a replayed state only shows what was recorded.

Is this security audit a penetration test?▼

No, it is a transport, header, and cookie hygiene scan only. It performs no fuzzing, injection, auth bypass, or CVE scanning, so a clean result means the hygiene checks passed, not that the site is secure — pair it with SAST/DAST tooling.

Why does the audit report no mixed content when the page has some?▼

Mixed-content detection derives from the captured network-error log, so it only catches http:// subresources that failed to load. Requests the browser upgraded or loaded successfully are invisible, so treat a clean result as 'none detected,' not proof none exists.

Does the audit distinguish enforcing CSP from Report-Only?▼

No, the header lookup falls back to Content-Security-Policy-Report-Only, so a monitor-only policy is analyzed as if it were enforcing and will not raise csp-missing. Mention this limitation when a site is rolling out CSP in report-only mode.

Related Skills

Explore More Software Engineering Skills→
algorithmbasicsalgorithmbasics

setup-browser-cookies

Import decrypted Chromium cookies into a Playwright headless session.

Community
Intermediate
tektonlabstektonlabs

vulnerability-report

Generate vulnerability tracking documentation with findings, severity ratings, and remediation status.

Official
Intermediate
stellaronestellarone

preview-checklist

Evaluate Builder.io pages against a pre-publish QA checklist.

Official
Intermediate
rfdiosuaorfdiosuao
30

security-audit

Audit application code for OWASP Top 10 vulnerabilities and CVE impacts.

Community
Advanced