Agent skill · security · jeremylongshore
analyzing-security-headers
Analyze HTTP security headers of web domains to identify vulnerabilities
Why this skill is useful
Provides specific compliance checks and remediation directives for HTTP security headers that the AI wouldn't generate on its own.
What it needs
About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Analyzing Security Headers Overview Evaluate HTTP response headers for web applications against OWASP Secure Headers Project recommendations and browser security baselines. Identify missing, misconfigured, or information-leaking headers across both HTTP and HTTPS responses. Prerequisites Target URL or domain name accessible over the network Authorization to perform HTTP requests against the target domain Network connectivity for both HTTP and HTTPS protocols Optional: write access to ${CLAUDESKILLDIR}/security-reports/ for persisting results Instructions 1. Accept the target domain. If only a domain name is provided, default to https://. For batch analysis, accept a newline-separated list. 2. Fetch response headers using WebFetch for both HTTP and HTTPS endpoints. Record the full redirect chain and final destination URL. 3. Evaluate critical headers -- flag any that are missing or misconfigured: Strict-Transport-Security: require max-age>=31536000, includeSubDomains, and preload eligibility Content-Security-Policy: check for unsafe-inline, unsafe-eval, overly broad default-src, and missing frame-ancestors X-Frame-Options: require DENY or SAMEORIGIN X-Content-Type-Options: require nosniff Permissions-Policy: verify camera, microphone, geolocation restrictions 4. Evaluate important headers -- report status and recommendations: Referrer-Policy: recommend strict-origin-when-cross-origin or no-referrer Cross-Origin-Embedder-Policy (COEP), Cross-Origin-Opener-Policy (COOP), Cross-Origin-Resource-Policy (CORP) 5. Check for information disclosure -- flag Server, X-Powered-By, X-AspNet-Version, and any header revealing technology stack or version numbers. 6. Inspect cookie attributes on Set-Cookie headers: verify Secure, HttpOnly, SameSite=Lax Strict, and Host-/Secure- prefix usage. 7. Calculate a security grade: A+ (95-100), A (85-94), B (75-84), C (65-74), D (50-64), F (<50) based on weighted presence and correctness of each header. 8. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/analyzing-security-headers