Agent skill · security · jeremylongshore
checking-http-security-headers
Audit a target's HTTP security headers — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the Cross-Origin trio (COOP, COEP, CORP). Use when: SOC2 / PCI auditor flagged "missing security headers" or a Mozilla Observatory grade is below B, OR you need HSTS preload eligibility for chrome://net-internals. Threshold: any missing required header on production HTML response, HSTS max-age below 31536000s (preload requirement), CSP with 'unsafe-inline' or 'unsafe-eval', X-Frame-Options absent AND CSP frame-ancestors absent (clickjacking), Cache-Control allowing public cache on authenticated endpoint. Trigger with: "audit security headers", "check csp", "hsts check", "header posture".
Why this skill is useful
Adds a Python script for auditing HTTP security headers that includes specific checks for vulnerabilities not commonly known.
What it needs
Requires python3 installed locally. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Checking HTTP Security Headers Overview HTTP response headers are the cheapest defense-in-depth layer most web apps ship. Each header closes one specific attack class — HSTS forces HTTPS, CSP blocks script injection, X-Frame-Options blocks clickjacking, etc. Missing headers don't break the app; they just leave the attack class open. This skill probes for the presence + value correctness of the canonical security-relevant headers. When the skill produces findings Finding Severity Threshold Affected control --- --- --- --- HSTS header missing HIGH No Strict-Transport-Security on HTTPS response OWASP A05:2021 HSTS max-age below preload threshold MEDIUM max-age under 31536000s (1y) hstspreload.org HSTS includeSubDomains missing for preload LOW preload directive without includeSubDomains hstspreload.org CSP header missing HIGH No Content-Security-Policy header OWASP A03:2021 CSP allows unsafe-inline MEDIUM script-src or style-src includes 'unsafe-inline' OWASP A03:2021 CSP allows unsafe-eval MEDIUM script-src includes 'unsafe-eval' OWASP A03:2021 CSP frame-ancestors AND X-Frame-Options both missing HIGH Clickjacking open CWE-1021 X-Content-Type-Options:nosniff missing MEDIUM MIME-sniff attack open OWASP A05:2021 Referrer-Policy missing or unsafe-url MEDIUM Cross-origin URL leakage OWASP A05:2021 Permissions-Policy missing LOW Camera/mic/geo permissions unrestricted Permissions Policy spec Server: header discloses version LOW nginx/1.18.0 → fingerprintable CWE-200 Cache-Control public on authenticated response HIGH Shared cache may serve user A's response to user B CWE-525 Prerequisites Python 3.9+ Authorization for non-local targets Instructions Step 1 — Confirm authorization Step 2 — Run the scanner Options: Step 3 — Interpret findings HIGH = open exploitable class (no HSTS = MITM downgrade open; no CSP = XSS class wide open; no clickjacking guard = UI-redress attacks). MEDIUM/LOW = posture hardening. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/checking-http-security-headers