Skip to content
Get packs

Content Security Policy Review

Reviews and helps implement a Content Security Policy to reduce XSS and injection risk on websites.

Source Download skill
Repository
thedaviddias/Front-End-Checklist
Stars
74,632
Licence
MIT
Files
2 files

What it does

This skill teaches an AI agent a security checklist for web pages: check whether a site sends a Content Security Policy header, review its rules, and look for risky patterns like inline scripts, eval, and unsafe HTML insertion. When asked to fix things, the agent recommends a strict policy, starting in report-only mode, and sanitizing untrusted HTML. It is a guide for the agent's reasoning and does not itself scan or change anything automatically.

Great for

  • Front-end or full-stack developers hardening a web app against XSS
  • Teams auditing HTTP headers and third-party scripts before a release
  • Reviewers who want a consistent CSP checklist for code reviews

Skip it if

  • Non-technical users expecting an automatic security scan; the skill only guides the agent and the reference page holds the detailed code examples
  • Production-critical changes made without testing, since a strict policy can break pages if deployed directly; start with report-only mode
  • Sites needing a complete security audit; it covers CSP only, not other vulnerabilities

Try asking

  • “Check whether my website sends a Content-Security-Policy header and tell me what's weak about it”
  • “Review this React component for innerHTML or dangerouslySetInnerHTML usage and whether it is sanitized”
  • “Draft a Content-Security-Policy-Report-Only header for my site that uses nonces instead of unsafe-inline”
  • “Review our third-party integrations and forms for CSP violations”
Step-by-step guide: how to use Content Security Policy ReviewInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the MIT licence and an attribution note.

    content-security-policy.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip content-security-policy.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip content-security-policy.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Deploy policies first as Content-Security-Policy-Report-Only and monitor the reports before enforcing.
  • Ask the agent to check the effective response in a production-like environment, since headers can differ between dev and prod.
  • Pair CSP with output encoding and sanitization; the skill itself notes CSP does not replace them.

What's inside

  • references/rule.md
  • SKILL.md

Redistributed unmodified from thedaviddias/Front-End-Checklist under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.