/http-sec-audit

name: http-sec-audit
description: >-
  Audit a website's HTTP security headers and cookie flags — CSP, HSTS,
  X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy,
  COOP/COEP, version-leaking banners, and Secure/HttpOnly/SameSite cookies. Use
  when the user asks to "check my site's security headers", "audit HTTP headers",
  "is my CSP/HSTS configured right", or "scan a URL for header misconfigs".
license: MIT

HTTP Security Header Audit

Checks a site's response headers against modern web-security best practices and returns prioritized findings with concrete fixes. The analysis core is pure and offline-testable; live scanning uses only Python's stdlib `urllib`.

When to use this skill

• "Audit the security headers on https://example.com."
• "Is my CSP / HSTS / cookie config correct?"
• "Why is this site flagged for missing headers?"

What it checks

• **Content-Security-Policy** — presence, `unsafe-inline`, wildcards.
• **Strict-Transport-Security** — presence and `max-age` length.
• **X-Content-Type-Options: nosniff**, **X-Frame-Options** / `frame-ancestors`.
• **Referrer-Policy**, **Permissions-Policy**.
• **Information disclosure** — `Server` / `X-Powered-By` version banners.
• **Cookies** — `Secure`, `HttpOnly`, `SameSite` (incl. `SameSite=None`

without `Secure`).

How to run it

# Live scan
python skills/http-sec-audit/audit.py https://example.com

# JSON output
python skills/http-sec-audit/audit.py https://example.com --json

# Offline: audit a saved raw header block (no network)
python skills/http-sec-audit/audit.py --headers-file response_headers.txt

# Only fail CI on high/critical (a missing Permissions-Policy is LOW and
# shows up on almost every site)
python skills/http-sec-audit/audit.py https://example.com --min-severity high

**Exit codes:** `0` clean · `1` findings reported · `2` fetch/usage error. Every reported finding fails the build; raise `--min-severity` to filter advisory findings out of both the report and the exit code.

Recommended workflow for Claude

1. Run the audit (live, or offline against captured headers). 2. Group findings by severity and present each with its one-line fix. 3. Offer ready-to-paste header snippets for the user's stack (nginx, Apache, Express, etc.) for the missing headers. 4. Only scan sites the user owns or is authorized to test.