Guide · Agent skill
How to use the Content Security Policy Review agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The Content Security Policy Review skill is an agent skill that gives an AI agent a security checklist for web pages. It focuses on whether a site sends a Content Security Policy header, how its rules are written, and whether the code contains risky patterns such as inline scripts, eval, and unsafe HTML insertion. This guide explains what the skill does, how to install it, how to ask for a review, and where its limits are.
Content Security Policy Reviewthedaviddias/Front-End-Checklist · MIT Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this page.
- 2Unzip the folder. Unzip it so the content-security-policy folder contains SKILL.md and references/rule.md.
- 3Place the skill. Move the folder into ~/.claude/skills/ for personal use, or into .claude/skills/ in your project.
- 4Or upload it in the apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the skill.
- 5Ask for a review. Describe the page, headers or code you want checked in plain language.
- 6Verify the findings. Check the agent's suggestions against the real production-like response before changing anything.
- 7Roll out safely. Start with Content-Security-Policy-Report-Only, monitor reports, then enforce.
What is an agent skill and what does this one make the agent do?
An agent skill is a folder of instructions that an AI agent can load when a task matches the skill's description. This skill's description covers reviewing headers, forms, cookies, or third-party integrations related to implementing a content security policy, and validating the effective browser and HTTP behavior in a production-like environment.
When the skill is active, the agent follows a checklist. It checks whether the site sends a Content-Security-Policy header and analyzes its directives. It reviews HTML injection points such as innerHTML and dangerouslySetInnerHTML, and notes whether Trusted Types or sanitization protects them. When asked to fix things, it recommends a strict policy, starting in report-only mode, and sanitizing untrusted HTML before rendering.
- Checks for a CSP header and reviews its directives
- Flags inline scripts, eval, and unsafe HTML insertion
- Recommends a strict default-src, then allows specific sources
- Recommends nonces or hashes instead of unsafe-inline
Install the content-security-policy skill
Download the ZIP for this skill from this page and unzip it. For a personal setup, place the unzipped folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.
You can also upload the skill in the Claude apps under Settings → Capabilities → Skills.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload
What files does the skill contain?
The skill has two files. SKILL.md holds the metadata, a quick reference, and the Check, Fix, Explain and Code Review instructions. references/rule.md holds the detailed code examples and the longer explanation of why sanitization matters.
The skill does not run scripts and does not use the network. It only guides the agent's reasoning.
- SKILL.md: instructions and quick reference
- references/rule.md: detailed code example and background
How do you trigger the skill with a natural request?
You do not need a special command. Describe the task in plain language that mentions headers, CSP, XSS, or the page you want reviewed. The agent should match the request to the skill's description and load its checklist.
Be specific about what you want reviewed. Naming a file, a form, or a server config gives the agent something concrete to check against the checklist.
- Review the Content Security Policy headers on this site and tell me what is weak.
- Check this template for innerHTML or dangerouslySetInnerHTML use and say whether it is sanitized.
- Help me write a CSP for this app. Start in report-only mode.
- Review this login form and its cookies for anything that breaks our CSP.
What does a typical review look like?
A good review names the exact response or code that is involved, says which rule is violated, and suggests a change. The skill asks the agent to verify findings against the effective production-like response, not just the code in the repository.
A reference policy from the reference page looks like this. Treat it as a starting point to test, not a drop-in setting.
- Look for unsafe-inline and unsafe-eval in script-src
- Check that default-src is restrictive and frame-ancestors is set
- Confirm that untrusted HTML is sanitized before it reaches the DOM
- Check the CSP header on the production-like response, not only the source
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; object-src 'none'; base-uri 'self'; form-action 'self';Safety notes: scripts, network and limits
The skill declares no required tools, runs no scripts, and uses no network access. The agent reasons from the files and the content you give it. It does not scan a live site on its own, and it does not change your code automatically.
The skill covers CSP only. It is not a complete security audit and will not find other kinds of vulnerabilities. A strict policy can break pages if deployed directly, so test changes first.
- Runs scripts: no
- Uses network: no
- Does not replace output encoding or sanitization
- Not a substitute for a full security audit
Tips for getting useful results
Give the agent the actual headers, the relevant template or component, and the framework you use. The reference page includes framework-specific guidance, so mention your stack if it matters.
Use the skill together with CSP reporting. The checklist says to monitor CSP reports to catch violations, which is the practical way to confirm a policy is safe before enforcing it.
- Paste the real response headers, not a guess
- Name your framework so the agent can use the right guidance
- Start with Content-Security-Policy-Report-Only before enforcing
- Prefer nonces or hashes over unsafe-inline for inline scripts
What people use it for
- Reviewing a site's Content-Security-Policy header before a release
- Checking a template or component for innerHTML or dangerouslySetInnerHTML use
- Drafting a first CSP for a web app, starting in report-only mode
- Reviewing forms, cookies and third-party scripts during a code review
Frequently asked questions
Is the content-security-policy skill free?
The skill is published under the MIT licence. The source does not list any price, so check the licence file in the repository for the exact terms.
What do I need to use this skill?
The source lists no required tools. You need an AI agent that supports skills, such as Claude, and the skill folder installed in the right place.
Does this skill scan my website automatically?
No. The skill only guides the agent's reasoning. It does not scan or change anything automatically, so you need to provide the headers or code to review.
Why does the skill recommend report-only mode?
A strict Content Security Policy can break pages if deployed directly. Content-Security-Policy-Report-Only lets you test the policy and monitor reports before enforcing it.
Does this skill replace a security audit?
No. It covers Content Security Policy only and is not a complete security audit. It does not find other kinds of vulnerabilities.
How is this different from a general security scanner?
A scanner runs checks automatically. This skill gives an agent a CSP checklist to follow during a review, and the agent's findings still need to be verified by you.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits front-end and full-stack developers who want an agent to review CSP headers and risky HTML patterns with a consistent checklist. It suits teams who want a repeatable review step before release. It is not the right choice if you want an automatic scan, a full security audit, or coverage of vulnerabilities beyond CSP.
Download the skill