skills.rest
jmrplens
jmrplensCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

csp-debug

Debug CSP and SRI violations for the jmrp.io project.

Updated Dec 14, 2025
Search Tags:#debugging#security#csp#web security#nginx#sri
One-click install
npx skills add https://github.com/jmrplens/jmrp.io --skill csp-debug
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: csp-debug
Source: https://github.com/jmrplens/jmrp.io/tree/main/.claude/skills/csp-debug
Command: npx skills add https://github.com/jmrplens/jmrp.io --skill csp-debug

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps developers diagnose and resolve Content Security Policy (CSP) and Subresource Integrity (SRI) violations within the jmrp.io project, ensuring enhanced web security.

Core Features & Use Cases

  • CSP Violation Analysis: Identifies common CSP issues like inline scripts/styles and data URIs.
  • SRI Hash Verification: Checks for missing or incorrect SRI integrity hashes on external resources.
  • Configuration Debugging: Assists in understanding and verifying the project's nonce-based CSP strategy and Nginx header configurations.
  • Use Case: If your website is suddenly breaking due to security headers, this Skill can pinpoint whether the issue lies with inline styles, missing script nonces, or incorrect SRI hashes on your CSS/JS files.

Quick Start

Run the security tests to verify CSP and SRI compliance on all pages.

Frequently Asked Questions about csp-debug

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I debug Content Security Policy violations caused by inline scripts and styles?▼

Debug CSP violations by analyzing inline scripts, inline styles, and data URIs within your project. This Skill pinpoints whether website breaking issues originate from missing script nonces or unauthorized inline styles, providing specific commands to identify violations in source code.

How do I verify missing SRI hashes on external CSS and JavaScript files?▼

Verify SRI hashes by checking the built HTML output for missing or incorrect integrity attributes on external resources. This Skill provides debugging commands to scan built files and confirm that Subresource Integrity hashes are correctly applied to CSS and JS assets.

What is a nonce-based CSP strategy and how do I check Nginx header configurations?▼

A nonce-based CSP strategy uses unique per-request tokens to authorize inline scripts securely. This Skill assists in understanding and verifying your project's nonce implementation and debugging Nginx header configurations to ensure generated headers match your security policy.

Can I integrate CSP and SRI debugging with SonarCloud for broader security analysis?▼

Yes, CSP and SRI debugging integrates with SonarCloud to provide broader web security analysis. This combination extends violation detection beyond local header checks, incorporating static application security testing results into your overall security posture evaluation.

Why does my website break after adding strict Content Security Policy headers?▼

Your website breaks after adding strict CSP headers due to blocked inline scripts, inline styles, missing SRI hashes, or unsupported data URIs. This Skill diagnoses these specific violations to determine whether the issue stems from nonces or integrity attributes.

Do I need Nginx configured to debug speculation rules and data URIs in my CSP?▼

Nginx configuration debugging is supported to verify generated headers, but analyzing speculation rules and data URIs focuses on source code and built HTML. This Skill checks both Nginx header outputs and frontend assets to identify comprehensive CSP violations.

Related Skills

Explore More Software Engineering Skills→
AnanyaBanerjeeAnanyaBanerjee

security

Secure static HTML pages with Cloudflare headers, SRI, and security audits.

Community
Advanced
Hack23Hack23
9

static-site-security

Apply security best practices to static websites hosted on GitHub Pages.

Official
Advanced
semicolon-devteamsemicolon-devteam

review

Validate Docker Compose, nginx, and environment-variable configurations and post PR review comments.

Official
Advanced
ok-helloworldok-helloworld
241

csp-bypass-advanced

Analyze CSP directives and browser fallbacks to identify XSS and data exfiltration bypass paths.

Community
Advanced