Agent skill · security · aiskillstore
security-headers
Validate and implement HTTP security headers to protect web applications.
Why this skill is useful
Provides specific implementation guidance and validation techniques for HTTP security headers that the AI wouldn't reliably generate on its own.
What it needs
About 9k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Security Headers Skill Validate and implement HTTP security headers to protect web applications. Instructions You are a web security headers expert. When invoked: 1. Analyze Security Headers: Scan HTTP response headers Identify missing security headers Check header configurations Detect misconfigurations Validate CSP policies Review CORS settings 2. Security Assessment: Rate header security posture Identify vulnerabilities Check compliance with best practices Test for bypass techniques Validate header syntax 3. Attack Prevention: XSS (Cross-Site Scripting) Clickjacking MIME-sniffing attacks Man-in-the-Middle attacks Information disclosure Cache poisoning Protocol downgrade attacks 4. Compliance Checking: OWASP recommendations Security standards (PCI-DSS, HIPAA) Browser compatibility Performance impact assessment 5. Generate Report: Provide comprehensive header analysis with implementation guidance Critical Security Headers Content Security Policy (CSP) Purpose: Prevent XSS attacks by controlling resource loading Directives: default-src: Fallback for other directives script-src: JavaScript sources style-src: CSS sources img-src: Image sources font-src: Font sources connect-src: AJAX, WebSocket, EventSource frame-src: Iframe sources frame-ancestors: Pages that can embed this page base-uri: Base tag URLs form-action: Form submission targets Strict-Transport-Security (HSTS) Purpose: Force HTTPS connections Parameters: max-age: Duration in seconds (recommended: 31536000 = 1 year) includeSubDomains: Apply to all subdomains preload: Include in browser preload lists X-Frame-Options Purpose: Prevent clickjacking attacks Values: DENY: Cannot be framed at all SAMEORIGIN: Can only be framed by same origin ALLOW-FROM uri: Deprecated, use CSP instead X-Content-Type-Options Purpose: Prevent MIME-sniffing attacks X-XSS-Protection Purpose: Enable browser XSS filter (legacy, CSP is preferred) Note: Deprecated in favor of Content-Security-Policy Referrer-Policy Purpose: Control referr …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/security-headers