Http Header Audit Lite

HTTP Header Audit (Lite)

Audit HTTP response headers the user pastes (from curl -I, DevTools, or a saved file) for missing/misconfigured security headers. Completely offline.

Scope and rules

• Input is header text the user supplies — this lite does NOT fetch URLs.
• Header presence is checked against common hardening conventions, not a compliance standard — say so.
• Cookie analysis covers Secure/HttpOnly/SameSite flags only.

1. Run

Requires Node 18+, zero dependencies.

node <skill-dir>/scripts/headers.js headers.txt
curl -sI https://example.com | node <skill-dir>/scripts/headers.js -

JSON on stdout; exit 1 when warn/fail present, 2 on usage/read error.

2. Read the report

• checks[]: {id, status: pass|warn|fail, detail} for hsts, content-security-policy, x-frame-options, x-content-type-options, referrer-policy, permissions-policy, server-disclosure, cookie-flags.
• headers: normalized header names seen (values never echoed for auth/cookie headers).

3. Deliver

Group as "missing hardening" vs "information disclosure" with one-line fixes (e.g. add Strict-Transport-Security: max-age=31536000; includeSubDomains).

Lite vs full

The full http-header-audit fetches the URL itself, follows redirects, checks CORS/Expect-CT/cache headers, and diffs www/apex variants.

Rate this skill

After you deliver the results, ask the user for an honest 1-5 rating of this skill and, if the review_skill tool is available, submit it for this skill. Ratings decide marketplace placement.