skills.rest
fusengine
fusengineCOMMUNITY
Explore all skills by this author →
Website𝕏@fusengineGitHub

security-headers

Audit and configure HTTP security headers for Next.js, Laravel, Express, and Django applications.

1|Updated Jul 29, 2026
Search Tags:#security headers#nextjs#csp#web security#http#hsts#helmet
One-click install
npx skills add https://github.com/fusengine/kimi-code --skill security-headers-fusengine
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-headers
Source: https://github.com/fusengine/kimi-code/tree/main/plugins/security-expert/skills/security-headers
Command: npx skills add https://github.com/fusengine/kimi-code --skill security-headers-fusengine

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Web applications missing HTTP security headers like Content-Security-Policy or Strict-Transport-Security are exposed to XSS, clickjacking, and man-in-the-middle attacks, and manually auditing each framework's configuration is error-prone. ## Core Features & Use Cases - Header Auditing: Checks seven security headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection) and ranks missing ones by severity from HIGH to LOW. - Framework Detection: Locates header configuration in Next.js next.config.js or middleware.ts, Laravel SecurityHeaders middleware, Express helmet, and Django SECURE_* settings. - Config Generation: Produces framework-specific fixes with ready-to-use code templates for each detected stack. - Use Case: Before deploying a Next.js app, run an audit to discover HSTS and CSP are missing, then apply the generated next.config.js headers block to close the gaps. ## Quick Start Audit the HTTP security headers of this web application and generate the missing configuration for its framework.

Frequently Asked Questions about security-headers

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add security headers to a Next.js application?▼

Add a headers function in next.config.js returning key-value pairs like X-Content-Type-Options: nosniff and X-Frame-Options: DENY, or set them in middleware.ts using response.headers.set. The skill generates this configuration automatically after auditing your app.

Which HTTP security headers are most important?▼

Content-Security-Policy and Strict-Transport-Security are HIGH severity because they prevent XSS and force HTTPS. X-Content-Type-Options and X-Frame-Options are MEDIUM, while Referrer-Policy, Permissions-Policy, and X-XSS-Protection are LOW.

How do I set security headers in Express with helmet?▼

Use the helmet middleware with app.use(helmet()) for defaults, then configure helmet.contentSecurityPolicy with directives like defaultSrc and scriptSrc. The skill provides a complete helmet configuration template.

Does this work with Laravel and Django applications?▼

Yes. For Laravel it audits and generates a SecurityHeaders middleware setting headers on the response. For Django it produces SECURE_* settings such as SECURE_HSTS_SECONDS, SECURE_CONTENT_TYPE_NOSNIFF, and X_FRAME_OPTIONS in settings.py.

What is the recommended Content-Security-Policy value?▼

A baseline recommendation is default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'. CSP controls which resources the browser can load, and misconfiguration leaves the app exposed to XSS attacks.

Related Skills

Explore More Software Engineering Skills→
jal-cojal-co
7

security-django

Audit Django security settings and middleware for misconfigurations.

Community
Advanced
igbuendigbuend
8

missing-security-headers-anti-pattern

Detect missing HTTP security headers in web application responses.

Community
Intermediate
LazyIsEfficientLazyIsEfficient
15

security-and-hardening

Audit web applications for input validation, session management, and dependency hygiene.

Official
Advanced
JayRHaJayRHa
3

nginx-config-pro

Generate nginx reverse-proxy configurations with TLS, caching, and security headers.

Community
Advanced