What problem does it solve? Security testers often misread CSP headers as static strings and cannot tell whether a policy actually blocks script injection or framing in a live browser, leading to false positives and missed client-side vulnerabilities. ## Core Features & Use Cases - Browser-Verified CSP Auditing: Records CSP sources, header merge rules, enforce vs report-only modes, nonce/hash, strict-dynamic, and Trusted Types, using Chrome console policy violations as primary evidence. - Minimal Harmless Validation: Confirms whether CSP blocks a target context using in-page harmless markers and self-hosted iframe demo pages, without external scripts or data exfiltration. - Clear Oracle and Routing: Distinguishes real exploitable gaps from non-issues like unreachable report endpoints, and routes confirmed XSS impact to hunt-xss/hunt-dom and UI impact to hunt-clickjacking. - Use Case: During an authorized web assessment, you spot a script nonce and a frame-ancestors header; this Skill verifies in Chrome whether injection or framing actually executes before reporting a finding. ## Quick Start Ask the agent to run the hunt-csp route against the authorized target to verify whether its CSP, Trusted Types, and frame-ancestors policies actually block injection and framing in a real browser.
