skills.rest
GoogleChrome
GoogleChromeOFFICIAL
Explore all skills by this author →
GitHub

web-security

Deploy Content Security Policy and Trusted Types to prevent XSS attacks.

926|71|Updated Jan 27, 2026
Search Tags:#security headers#csp#web security#xss prevention#web app hardening#secure cookies#cross-origin isolation
One-click install
npx skills add https://github.com/GoogleChrome/modern-web-guidance-src --skill web-security-googlechrome
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web-security
Source: https://github.com/GoogleChrome/modern-web-guidance-src/tree/main/skills-src/security
Command: npx skills add https://github.com/GoogleChrome/modern-web-guidance-src --skill web-security-googlechrome

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Web applications are frequently vulnerable to common attacks like cross-site scripting (XSS), insecure cookie theft, clickjacking, and misconfigured security policies due to legacy code patterns and lack of structured security guidance, leaving user data and systems exposed.

Core Features & Use Cases

  • Phased Security Rollouts: Provides tailored guidelines for retrofitting existing applications, building new greenfield apps, or setting secure defaults for SaaS templates, minimizing breakage risk during policy deployment.
  • Comprehensive Policy Coverage: Covers core security controls including Content Security Policy (CSP), Trusted Types, cross-origin isolation (COOP/COEP/CORP), and companion headers like HSTS, Permissions Policy, and SRI.
  • Use Case: A team maintaining a legacy e-commerce site can use this skill to first fix quick hygiene issues like insecure cookies and dangerous DOM sinks, then run report-only policy tests to identify breakages before enforcing strict CSP rules to block XSS attacks.

Quick Start

Use the web-security skill to guide your team through auditing your web application's current security gaps and deploying a phased rollout of preventative security policies, starting with quick hygiene fixes and report-only testing before enforcing strict rules.

Frequently Asked Questions about web-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I deploy Content Security Policy without breaking my web app?▼

To deploy Content Security Policy (CSP) without breakage, use a phased rollout that starts with report-only policy testing to identify violations, then data-driven enforcement decisions to enforce strict CSP rules and block XSS attacks.

What's the best way to harden a legacy web application against XSS?▼

The best way to harden a legacy web app against XSS is a phased approach: first fix quick hygiene issues like insecure cookies and dangerous DOM sinks, then run report-only policy tests before enforcing strict rules.

How does cross-origin isolation protect web apps?▼

Cross-origin isolation protects web apps by deploying COOP, COEP, and CORP headers to prevent cross-origin attacks, mitigating risks like clickjacking and insecure data access across different origins.

Can I retrofit Trusted Types enforcement on an existing application?▼

Yes, you can retrofit Trusted Types enforcement on an existing application by following phased, low-breakage rollout guidelines that prioritize report-only policy testing to identify unsafe DOM code patterns before strict enforcement.

What security headers do I need for web app hardening?▼

Web app hardening requires configuring security headers including Content Security Policy (CSP), HSTS, Permissions Policy, Subresource Integrity (SRI), and cross-origin isolation headers like COOP, COEP, and CORP.

Related Skills

Explore More Software Engineering Skills→
Weihong-LiuWeihong-Liu
6

security-review

Audit code for OWASP Top 10 vulnerabilities, hardcoded secrets, and unsafe patterns.

Community
Advanced
SnailSploitSnailSploit
2.9k

xss

...

Community
Advanced
mattnowdevmattnowdev

super-review:web-headers

Detect insecure or missing HTTP response headers in PR diffs.

Community
Intermediate
AndyAnh174AndyAnh174

Cross-Site Scripting and HTML Injection Testing

Detect and exploit stored, reflected, and DOM-based XSS vulnerabilities.

Community
Advanced