Security Headers CSP Auditor

The problem

Security headers are often present but misconfigured, providing a false sense of security while leaving sites vulnerable to XSS, clickjacking, and session hijacking. Manually auditing complex CSP strings and CORS configurations is error-prone and time-consuming.

What it does

• Analyzes raw HTTP response headers for missing or weak security configurations.
• Performs deep directive-by-directive audits of Content-Security-Policy (CSP) to flag bypasses like unsafe-inline or over-broad wildcards.
• Identifies dangerous CORS patterns, specifically the origin-reflection plus credentials trap.
• Audits Set-Cookie flags for session protection, including HttpOnly, Secure, and SameSite.
• Prioritizes findings based on exploitability, moving beyond simple presence-checks to evaluate actual value effectiveness.

Why this beats prompting it yourself

General-purpose LLMs often report a header as "safe" just because the key exists. This skill uses specific logic to detect subtle CSP bypasses and invalid CORS combinations that standard prompts miss. It provides exact syntax for nonce-based or hash-based remediations rather than generic advice.

Use cases

• Auditing a production site by pasting raw headers from browser DevTools.
• Hardening CSP for an application that currently uses unsafe-inline.
• Verifying session cookie security flags during a security review.
• Debugging CORS errors that might be masking serious misconfigurations.

Known limitations

Requires raw header data or curl output to be provided by the user, as it cannot directly fetch headers from a URL. Focused on HTTP response-level security, not application-layer logic vulnerabilities.