Skills DirectoryCurated open-source Skills from GitHub
English

content-security-policycommit 4b0ddb9SKILL.md · Hardening

Implement a Content Security Policy

Checks for and implements a strict Content Security Policy, combined with HTML sanitization and Trusted Types against XSS and injection.

npx skills add thedaviddias/Front-End-Checklist --skill content-security-policy
Permissions
  • read-repo
  • write-files
  • shell
  • network
Compatible with
Any SKILL.md agent
GitHub
74.6k
Source
Community · David Dias
Status
Scan passed
License
MIT
Category
Hardening
Repository
github.com/thedaviddias/Front-End-Checklist/skills/content-security-policy

Core rule

CSP reduces blast radius; it does not replace output encoding and sanitization.

Execution Phases

  1. Phase 01Check

    Check for a CSP header and its directives, and review sinks such as innerHTML and dangerouslySetInnerHTML.

  2. Phase 02Start report-only

    Test with Content-Security-Policy-Report-Only first and collect violation reports so nothing breaks.

  3. Phase 03Tighten

    Set a strict default-src and allow specific sources; use nonces or hashes for inline scripts and avoid unsafe-inline and unsafe-eval.

  4. Phase 04Verify in production-like env

    Verify the effective response in a production-like environment; larger apps can add Trusted Types as defense in depth.

Permissions (summarised from SKILL.md)

CapabilityNeededDetails
File writesRequiredEdits server or framework config to set CSP headers and adds sanitization at injection sinks.
Command executionNot requiredThe skill does not call for specific commands.
Network outboundLimitedAccesses the target site only to verify its effective response headers.

SKILL.md frontmatter (YAML)

SKILL.md frontmatter (YAML)commit 4b0ddb9
---
name: content-security-policy
description: "Use when reviewing headers, forms, cookies, or third-party integrations related to Implement a content security policy. Validate the effective browser and HTTP behavior in a production-like environment."
metadata:
  category: security
  priority: high
  difficulty: advanced
  estimatedTime: "45"
  source: frontendchecklist.io
  url: https://frontendchecklist.io/rules/security/content-security-policy
---

Related skills

A rule scan cannot catch every risk. Read this skill's SKILL.md and check its permissions before installing.
Markdown version GitHub