Analyze Content-Security-Policy configurations for unsafe directives and bypass patterns.
npx skills add https://github.com/Q16G/aster --skill csp-audit
Please help me install this Agent Skill. Skill: csp-audit Source: https://github.com/Q16G/aster/tree/main/skills/code-audit/csp-audit Command: npx skills add https://github.com/Q16G/aster --skill csp-audit
CSP configurations can be misconfigured, allowing XSS and data exfiltration through bypasses. This skill analyzes existing CSP policies to identify unsafe directives, missing nonces, and weak baselines, enabling targeted fixes.
Run this skill on a project with CSP headers to identify potential bypass risks and actionable fixes.
High-intent search queries and answers about installing and using this skill.
To audit a Content-Security-Policy header for XSS risks, analyze existing configurations to identify unsafe directives, missing nonces or hashes, and common bypass patterns in script-src and object-src. This evaluates your security posture and generates actionable remediation steps.
A CSP bypass exploits weak script-src directives to execute unauthorized scripts. Misconfigured policies allowing unsafe-inline or missing strict-dynamic enable attackers to inject malicious code, bypassing intended restrictions and allowing potential data exfiltration.
To fix a weak Content-Security-Policy, apply hardening recommendations by proposing nonce or hash usage and integrating strict-dynamic. This replaces unsafe-inline directives, mitigating common bypass vectors and establishing a stricter baseline for script execution.
Yes, you can evaluate report-only modes and base-uri directives during a CSP security audit. The analysis assesses these configurations alongside default-src to identify missing nonces, weak baselines, and potential bypass opportunities for comprehensive compliance.
Limitations of Content-Security-Policy configurations against data exfiltration include overly permissive default-src settings and missing object-src restrictions. Without strict-dynamic and proper nonce implementation, weak baselines allow attackers to bypass policies and extract sensitive data.
manastalukdarValidates and generates web framework security header configurations.
utsavthakurAnalyze Content Security Policy configurations and identify bypass vectors for directives.
aaronjmarsAudit skill markdown files for security threats and vulnerabilities.
Sir-chawakornConfigure HTTP security headers and strict nonce-based Content-Security-Policy directives.
