skills.rest
igbuend
igbuendCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

content-security-policy

Analyze Content-Security-Policy headers for misconfigurations and bypass risks.

8|1|Updated Jan 19, 2026
Search Tags:#security#audit#csp#web security#headers#xss prevention
One-click install
npx skills add https://github.com/igbuend/grimbard --skill content-security-policy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: content-security-policy
Source: https://github.com/igbuend/grimbard/tree/main/skills/content-security-policy
Command: npx skills add https://github.com/igbuend/grimbard --skill content-security-policy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, grep, glob, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps you analyze and improve your website's Content Security Policy (CSP) to prevent XSS attacks and other web vulnerabilities.

Core Features & Use Cases

  • CSP Analysis: Detects misconfigurations, unsafe directives, and known bypasses in your CSP.
  • Security Scoring: Assigns a grade (A-F) based on the strength of your CSP.
  • Remediation Guidance: Provides specific recommendations and example CSP configurations to fix identified issues.
  • Use Case: You've implemented a CSP but are unsure if it's truly effective. This Skill will audit your policy, identify weaknesses like unsafe-inline or overly broad allowlists, and suggest concrete steps to harden it.

Quick Start

Review the Content-Security-Policy header for the website example.com.

Frequently Asked Questions about content-security-policy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit my Content Security Policy header for misconfigurations?▼

To audit a Content Security Policy header, provide a raw CSP string, URL, domain, or file path. The analysis detects unsafe directives, identifies known bypasses, and outputs detailed findings with CVSS scores.

What are common CSP bypass risks and unsafe directives I should look for?▼

Common CSP bypass risks include unsafe-inline directives and overly broad allowlists. Analyzing the CSP reveals these vulnerabilities, assigns a security grade, and provides specific remediation guidance to harden the policy.

Can I check a website's CSP security using just a URL or domain?▼

Yes, you can check a website's CSP security using a URL or domain. The process fetches the web resource, parses the Content Security Policy header, and assesses policy strength based on security best practices.

What is the best way to generate a secure Content Security Policy configuration?▼

The best way to generate a secure Content Security Policy is to analyze the current policy for weaknesses. The audit provides concrete recommendations and example CSP configurations to fix identified misconfigurations and prevent XSS attacks.

Does CSP analysis work with raw header strings or local files?▼

Yes, CSP analysis works with raw header strings and local file paths. The process parses the provided string or file, utilizing security pattern matching to evaluate adherence to best practices and identify potential bypass risks.

Related Skills

Explore More Software Engineering Skills→
hoanghn61hoanghn61

security-posture-analyzer

Analyze HTTP, DNS, HTML, and repository signals to produce prioritized security recommendations.

Community
Intermediate
jd-opensourcejd-opensource
299

pentest-config-hardening

Audit HTTP security headers, TLS settings, and CSP policies across web assets.

Official
Advanced
qdzshqdzsh
12

best-practices

Audit web projects for HTTPS, CSP, security headers, and accessible HTML.

Community
Intermediate
zivtechzivtech

security-ownership-mapper

Analyze git history to map code ownership and bus factors.

Official
Intermediate