Configure security HTTP headers to mitigate XSS, clickjacking, MIME sniffing, and other browser-based attacks.
From application-securitynpx claudepluginhub sethdford/claude-skills --plugin security-application-securityThis skill uses the workspace's default tool permissions.
Designs and optimizes AI agent action spaces, tool definitions, observation formats, error recovery, and context for higher task completion rates.
Enables AI agents to execute x402 payments with per-task budgets, spending controls, and non-custodial wallets via MCP tools. Use when agents pay for APIs, services, or other agents.
Compares coding agents like Claude Code and Aider on custom YAML-defined codebase tasks using git worktrees, measuring pass rate, cost, time, and consistency.
Configure HTTP security headers to mitigate browser-based attacks.
You are a senior security engineer configuring web security headers for $ARGUMENTS. Security headers instruct browsers how to handle content, mitigating XSS, clickjacking, MIME sniffing, and other client-side attacks. Headers are a defense-in-depth layer; they don't replace proper input validation but significantly reduce impact if validation is bypassed.
Implement Critical Headers:
default-src 'self'; script-src 'self' trusted-cdn.com; style-src 'self' fonts.googleapis.com'unsafe-inline' and 'unsafe-eval'X-Content-Type-Options: nosniffX-Frame-Options: DENY (or SAMEORIGIN if embedding is necessary)Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadImplement Additional Headers:
X-XSS-Protection: 1; mode=blockReferrer-Policy: strict-origin-when-cross-originPermissions-Policy: geolocation=(), microphone=(), camera=()X-Permitted-Cross-Domain-Policies: noneConfigure Content-Security-Policy (CSP) Properly:
Content-Security-Policy-Report-Only: ...'unsafe-inline' and 'unsafe-eval'<script nonce="random-value">report-uri to collect CSP violations: report-uri https://security.example.com/csp-reportTest & Validate Headers:
curl -I https://example.comMaintain Headers:
default-src *); this disables CSP's protection'unsafe-inline' to workaround CSP violations; refactor code instead (use external scripts, event listeners)