skills.rest
zebbern
zebbernCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

header-analysis

Identify misconfigurations and omissions in HTTP security headers using httpx.

5|3|Updated Apr 10, 2026
Search Tags:#csp#analyze#httpx#hsts#security-headers#x-frame-options#x-content-type-options
One-click install
npx skills add https://github.com/zebbern/termstack --skill header-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: header-analysis
Source: https://github.com/zebbern/termstack/tree/main/.github/skills/header-analysis
Command: npx skills add https://github.com/zebbern/termstack --skill header-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Web targets often misconfigure or omit critical security headers, exposing them to leverage attacks; this skill helps identify and document these gaps to tighten defenses.

Core Features & Use Cases

  • Automated extraction and analysis of common security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, CORS) across single targets or bulk scans.
  • Actionable remediation guidance and OWASP-aligned recommendations to improve header posture.
  • Use Case: Run a quick audit of a new web app to ensure essential headers are present and correctly configured.

Quick Start

Configure a scan to inspect a target and output a structured header report.

Frequently Asked Questions about header-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check HTTP security headers for missing HSTS and CSP configurations?▼

Automated extraction and analysis of common security headers like HSTS, CSP, and X-Frame-Options can identify misconfigurations across web targets. It requires httpx for header extraction and provides JSON output for integration with workflows.

What HTTP security headers should I audit to ensure web app compliance?▼

You should audit HTTP security headers including HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and CORS. Scanning these headers ensures essential configurations are present and correctly configured to tighten web defenses.

Can I run bulk scans to analyze security headers across multiple web targets?▼

Yes, bulk scans support security assessments across multiple web targets. The analysis automates extraction and checks for omissions in headers like X-Frame-Options and X-Content-Type-Options, outputting a structured JSON report for integration with workflows.

Does header analysis require httpx to extract headers from web targets?▼

Yes, this header analysis requires httpx for extracting and analyzing HTTP security headers from web targets. The skill uses httpx to identify misconfigurations and omissions, providing structured JSON output for workflow integration.

How do I get OWASP-aligned remediation guidance for missing security headers?▼

OWASP-aligned remediation guidance is provided after automated extraction and analysis of security headers. The skill evaluates headers like CSP and HSTS, offering actionable recommendations to improve your header posture and tighten defenses.

What is the best way to document security header gaps for a new web application?▼

The best way to document security header gaps is to configure a scan that inspects the target and outputs a structured JSON header report. This identifies misconfigurations in headers like CSP and HSTS to minimize the attack surface.

Related Skills

Explore More Software Engineering Skills→
dapperdiversdapperdivers
1

header-analysis

Audit HTTP response headers and cookie attributes for missing security controls.

Community
Intermediate
Logisoft-webLogisoft-web

vulnerability-scanner

Scan code repositories for vulnerabilities in dependencies, secrets, and configurations.

Community
Advanced
dmzoneilldmzoneill
2

security-audit

Audit network and TLS configurations with nmap, openssl, curl, and ssh-keyscan.

Community
Advanced
EntroVyxEntroVyx
3

subdomain-enumeration

Automate subdomain discovery via certificate logs, APIs, and HTTP probing.

Community
Intermediate