csp-headers

Name: csp-headers
Availability: InStock
Author: jtucker9

Configure Content-Security-Policy and related HTTP security headers for web applications.

Updated Mar 13, 2026

Search Tags:#audit #csp #web-security #policy #security-headers #http-security

Ready to run

npx skills add https://github.com/jtucker9/mystuff --skill csp-headers

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: csp-headers
Source: https://github.com/jtucker9/mystuff/tree/main/skills/security/csp-headers
Command: npx skills add https://github.com/jtucker9/mystuff --skill csp-headers

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detect and enforce robust HTTP security headers (CSP, HSTS, X-Frame-Options, etc.) to protect web applications from common web vulnerabilities.

Core Features & Use Cases

Audit existing headers and report gaps against recommended policies.
Build a tailored Content-Security-Policy and related headers for nginx, Apache, Caddy, Express, Next.js, and Cloudflare Workers.
Rollout CSP safely using report-only mode before enforcement, with violation monitoring and remediation guidance.

Quick Start

Configure and deploy a baseline CSP and security headers policy for your web app.

Frequently Asked Questions about csp-headers

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I configure Content-Security-Policy headers for a web application?▼

Configure Content-Security-Policy headers by building tailored CSP directives and outputting ready-to-paste platform configurations for nginx, Apache, Caddy, Express, Next.js, and Cloudflare Workers.

What's the best way to audit existing HTTP security headers?▼

Audit existing HTTP security headers by checking your web application's current response against recommended policies, reporting gaps in CSP, HSTS, and X-Frame-Options to identify missing protections.

Can I roll out CSP safely using report-only mode before enforcement?▼

Roll out CSP safely using report-only mode to monitor violations before full enforcement, providing remediation guidance to fix policy breaches without breaking web application functionality.

Does this support generating HSTS and X-Frame-Options configurations for Next.js?▼

Generating HSTS and X-Frame-Options configurations is fully supported for Next.js, alongside nginx, Apache, Caddy, Express, and Cloudflare Workers, providing ready-to-paste platform security header outputs.

Why do I need a Content-Security-Policy header for my web app?▼

Content-Security-Policy headers are needed to protect web applications from common web vulnerabilities like cross-site scripting and data injection by enforcing robust source restrictions and security policies.

What are the limitations of enforcing strict CSP without report-only testing?▼

Enforcing strict CSP without report-only testing can break web application functionality by blocking legitimate scripts and resources, so violation monitoring and incremental policy building are recommended before enforcement.