/csp-headers

name: memstack-security-csp-headers
description: "Use this skill when the user says 'CSP', 'Content-Security-Policy', 'security headers', 'HSTS', 'X-Frame-Options', 'clickjacking', 'unsafe-inline', 'unsafe-eval', or needs to audit, generate, or fix HTTP security headers for a web application. Do NOT use for API route audits or dependency scanning."
version: 1.0.0
license: "Proprietary, MemStack™ Pro by CW Affiliate Investments LLC. See LICENSE.txt"

🛡️ CSP Headers: Security Headers Auditor & Generator

*Audit existing security headers, identify overly permissive directives, and generate a production-ready Content-Security-Policy with companion headers.*

Activation

When this skill activates, output:

`🛡️ CSP Headers: Auditing your security headers...`

| Context | Status | |---------|--------| | **User says "CSP", "security headers", "Content-Security-Policy"** | ACTIVE | | **User wants to fix unsafe-inline, unsafe-eval, or wildcard directives** | ACTIVE | | **User mentions HSTS, X-Frame-Options, or Permissions-Policy** | ACTIVE | | **User wants a full OWASP security audit (not just headers)** | DORMANT: see owasp-top10 | | **User wants to scan for secrets in code** | DORMANT: see secrets-scanner | | **User wants API-level security (auth, rate limiting)** | DORMANT: see api-audit |

Protocol

Step 1: Gather Inputs

Ask the user for:

• **Framework**: Next.js, Express, Fastify, Nginx, Caddy, static hosting?
• **CDN/hosting**: Vercel, Netlify, Cloudflare, self-hosted?
• **External resources**: Which third-party scripts, fonts, images, or APIs are loaded? (analytics, payment widgets, CDNs)
• **Inline scripts**: Does the app use inline `<script>` tags or inline styles?
• **Iframes**: Does the app embed iframes or get embedded by others?

Step 2: Scan Existing Headers

Check for CSP and security headers in all possible locations:

**Where to look:** 1. **Middleware**: Express/Next.js middleware setting response headers 2. **Config files**: `next.config.js` (`headers()` function), `nginx.conf`, `Caddyfile` 3. **Meta tags**: `<meta http-equiv="Content-Security-Policy" content="...">` in HTML 4. **Hosting config**: `vercel.json`, `netlify.toml`, `_headers` file 5. **Reverse proxy**: Nginx/Caddy/Apache header directives

── EXISTING HEADERS FOUND ─────────────────

Location: [file:line or "not found"]

Content-Security-Policy:
  [current policy or "MISSING"]

Strict-Transport-Security:
  [current value or "MISSING"]

X-Content-Type-Options:
  [current value or "MISSING"]

X-Frame-Options:
  [current value or "MISSING"]

Referrer-Policy:
  [current value or "MISSING"]

Permissions-Policy:
  [current value or "MISSING"]

X-XSS-Protection:
  [current value or "MISSING, deprecated but still useful for older browsers"]

Step 3: Audit CSP Directives

If a CSP exists, audit each directive for security issues:

| Directive | Current Value | Issue | Severity | Fix | |-----------|--------------|-------|----------|-----| | `default-src` | `*` | Allows loading from any origin | 🔴 Critical | Restrict to known origins | | `script-src` | `'unsafe-inline'` | Allows inline scripts, XSS vector | 🔴 Critical | Use nonces or hashes | | `script-src` | `'unsafe-eval'` | Allows dynamic code execution, injection risk | 🟡 High | Remove, refactor code | | `style-src` | `'unsafe-inline'` | Allows inline styles, less severe | 🟠 Medium | Use nonces if feasible | | `img-src` | `*` | Allows images from any origin | 🟠 Medium | Restrict to known CDNs | | `frame-ancestors` | missing | No clickjacking protection | 🟡 High | Add `'self'` or `'none'` | | `connect-src` | missing | No restriction on fetch/XHR targets | 🟠 Medium | Restrict to API origins | | `base-uri` | missing | Base tag injection possible | 🟡 High | Add `'self'` | | `form-action` | missing | Forms can submit to any origin | 🟠 Medium | Add `'self'` | | `object-src` | missing | Plugin content allowed | 🟡 High | Add `'none'` |

**Common dangerous patterns:**

BAD:  default-src *                    → Defeats the entire purpose of CSP
BAD:  script-src 'unsafe-inline'       → XSS protection nullified
BAD:  script-src 'unsafe-eval'         → Dynamic code execution permitted
BAD:  script-src https:                → Any HTTPS origin can serve scripts
BAD:  script-src *.googleapis.com      → JSONP endpoints can bypass CSP
BAD:  connect-src *                    → Data exfiltration unrestricted
BAD:  frame-ancestors not set          → Clickjacking possible

Step 4: Inventory External Resources

Identify all external resources the application loads:

── RESOURCE INVENTORY ─────────────────────

Scripts (script-src):
  - https://www.googletagmanager.com:     Google Tag Manager
  - https://js.stripe.com:                Stripe.js
  - https://cdn.jsdelivr.net:              jsDelivr CDN
  - 'self':                                Own domain scripts

Styles (style-src):
  - https://fonts.googleapis.com:          Google Fonts CSS
  - 'self':                                Own stylesheets
  - 'unsafe-inline':                       Needed for: [reason]

Fonts (font-src):
  - https://fonts.gstatic.com:             Google Fonts files
  - 'self':                                Self-hosted fonts

Images (img-src):
  - https://res.cloudinary.com:            Cloudinary images
  - https://*.githubusercontent.com:       GitHub avatars
  - data::                                 Data URI images
  - 'self':                                Own images

Connections (connect-src):
  - https://api.example.com:               Own API
  - https://api.stripe.com:                Stripe API
  - https://www.google-analytics.com:      Analytics
  - 'self':                                Same-origin requests

Frames (frame-src):
  - https://js.stripe.com:                 Stripe checkout iframe
  - https://www.youtube.com:               Embedded videos
  - 'none':                                If no iframes needed

Step 5: Generate Recommended CSP