skills.rest
sjinks
sjinksCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-review-owasp-content-security-policy

Analyze Content Security Policy implementations for security weaknesses against OWASP guidance.

Updated Mar 26, 2026
Search Tags:#xss#owasp#clickjacking#security review#csp#nonce#frame-ancestors
One-click install
npx skills add https://github.com/sjinks/ai-owasp-skillset --skill security-review-owasp-content-security-policy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review-owasp-content-security-policy
Source: https://github.com/sjinks/ai-owasp-skillset/tree/main/.github/skills/security-review-owasp-content-security-policy
Command: npx skills add https://github.com/sjinks/ai-owasp-skillset --skill security-review-owasp-content-security-policy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps reviewers detect weak Content Security Policy deployments that still allow script injection, unsafe inline execution, framing abuse, or misleading report-only protection.

Core Features & Use Cases

  • Policy Delivery Review: Checks whether CSP is enforced through the right response headers across pages, routes, and error states.
  • Script and Framing Controls: Evaluates nonce or hash discipline, unsafe directives, object and base restrictions, and frame-ancestors coverage.
  • Reporting and Exceptions: Looks for weak reporting setup, noisy wildcards, and over-broad exceptions that reduce CSP value.
  • Use Case: Review a login or payment flow to confirm its CSP actually limits exploitability instead of merely documenting intent.

Quick Start

Use the security-review-owasp-content-security-policy skill to inspect the relevant headers, HTML, and route behavior for CSP delivery, nonce handling, framing rules, and reporting gaps.

Frequently Asked Questions about security-review-owasp-content-security-policy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a Content Security Policy header for XSS and clickjacking weaknesses?▼

To review a Content Security Policy for XSS and clickjacking, analyze response headers and HTML meta tags to validate strict script delivery, per-response nonces, frame-ancestors coverage, and object-src restrictions against OWASP guidance.

What makes a Content Security Policy weak against script injection?▼

A Content Security Policy is weak against script injection when it lacks strict nonce or hash discipline, relies on unsafe inline directives, uses noisy wildcards, or applies over-broad exceptions that reduce its protective value.

How do I check if CSP is properly enforced across all application routes?▼

To check CSP enforcement across routes, inspect response headers on all pages and error states to confirm the policy is actively enforced rather than merely documented through report-only protection.

Does my login flow need frame-ancestors and base-uri restrictions in its CSP?▼

Yes, login flows require frame-ancestors and base-uri restrictions in their CSP to prevent framing abuse and clickjacking, limiting actual exploitability rather than just documenting security intent.

What are the limitations of using CSP report-only mode for security?▼

CSP report-only mode is limited because it documents violation intent without actively blocking script injection, unsafe inline execution, or framing abuse, leaving the application exposed to actual exploits.

Related Skills

Explore More Software Engineering Skills→
MatheusrlrMatheusrlr
1

best-practices

Apply modern web development best practices for security, compatibility, and code quality.

Community
Intermediate
Sir-chawakornSir-chawakorn
9

configure-security-headers-csp

Configure HTTP security headers and strict nonce-based Content-Security-Policy directives.

Community
Advanced
cwinvestmentscwinvestments
412

memstack-security-csp-headers

Audit, generate, and fix HTTP security headers including CSP, HSTS, and X-Frame-Options.

Community
Intermediate
rahmatullahbossrahmatullahboss

File Path Traversal Testing

Test web applications for directory traversal vulnerabilities using payloads and encoding bypasses.

Community
Intermediate