super-review:web-headers

What problem does it solve?

This Skill prevents common web-security misconfigurations in HTTP response headers that can weaken defenses against XSS, clickjacking, session theft, CORS abuse, and transport downgrade attacks.

Core Features & Use Cases

• CSP hardening: Flags dangerous CSP patterns like unsafe-inline/unsafe-eval usage for script-src, and enforces required directives such as base-uri and frame-ancestors, plus optional Trusted Types guidance.
• Cookie and transport protection: Validates HSTS settings and cookie attributes (Secure/HttpOnly/SameSite, __Host- prefix, and CHIPS Partitioned where relevant).
• Cross-origin and browser isolation controls: Reviews CORS reflection and credential handling, plus COOP/COEP requirements for cross-origin isolation.
• Policy headers coverage: Checks Permissions-Policy, Referrer-Policy, and recommends SRI for third-party subresources, while ensuring consistency with X-Frame-Options/CSP frame-ancestors.

Quick Start

Ask the reviewer to analyze the PR diff for missing or unsafe security headers and produce a bounded list of fix-before-merge recommendations with quoted evidence.