Agent skill · security · yaklang
csp-bypass-advanced
Advanced Content Security Policy bypass techniques. Use when XSS or data exfiltration is blocked by CSP and you need to find policy weaknesses, trusted endpoint abuse, nonce leakage, or exfiltration channels that CSP cannot block.
Why this skill is useful
Adds advanced techniques and specific bypass methods for CSP that are not commonly known or documented.
What it needs
About 7k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: CSP Bypass — Advanced Techniques AI LOAD INSTRUCTION: Covers per-directive bypass techniques, nonce/hash abuse, trusted CDN exploitation, data exfiltration despite CSP, and framework-specific bypasses. Base models often suggest unsafe-inline bypass without checking if the CSP actually uses it, or miss the critical base-uri and object-src gaps. 0. RELATED ROUTING xss-cross-site-scripting for XSS vectors to deliver after CSP bypass dangling-markup-injection when CSP blocks scripts but HTML injection exists — exfiltrate without JS crlf-injection when CRLF can inject CSP header or steal nonce via response splitting waf-bypass-techniques when both WAF and CSP must be bypassed clickjacking when CSP lacks frame-ancestors — clickjacking still possible --- 1. CSP DIRECTIVE REFERENCE MATRIX Directive Controls Default Fallback --- --- --- default-src Fallback for all -src directives not explicitly set None (browser default: allow all) script-src JavaScript execution default-src style-src CSS loading default-src img-src Image loading default-src connect-src XHR, fetch, WebSocket, EventSource default-src frame-src iframe/frame sources default-src font-src Font loading default-src object-src <object>, <embed>, <applet> default-src media-src <audio>, <video> default-src base-uri <base> element No fallback — unrestricted if absent form-action Form submission targets No fallback — unrestricted if absent frame-ancestors Who can embed this page (replaces X-Frame-Options) No fallback — unrestricted if absent report-uri / report-to Where violation reports are sent N/A navigate-to Navigation targets (limited browser support) No fallback Critical insight: base-uri, form-action, and frame-ancestors do NOT fall back to default-src. Their absence is always a potential bypass vector. --- 2. BYPASS TECHNIQUES BY DIRECTIVE 2.1 script-src 'self' The app only allows scripts from its own origin. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/csp-bypass-advanced