script-src 'self' https: lets an injected script load from any HTTPS server, default-src self without quotes allows only a host named "self", a nonce written into nginx.conf is the same for every visitor, and frame-ancestors in a meta tag is ignored. Each looks like protection in a review and gives none. This skill finds those and the other CSP mistakes below before you ship, and tells you how to fix each one.

Your agent runs a scanner on HTML pages and templates, nginx, Apache and Caddy configs, _headers files, vercel.json, firebase.json, staticwebapp.config.json, netlify.toml, IIS web.config, Next.js next.config and proxy or middleware files, helmet options, Django SECURE_CSP and django-csp settings, Spring Security policyDirectives, and CSP header strings in Python, PHP, Ruby, Go, Java and C# code. It reads each policy the way CSP Level 3 browsers do (a nonce or hash turns off 'unsafe-inline', 'strict-dynamic' turns off host lists, base-uri and frame-ancestors do not fall back to default-src), follows values through template literals, string concatenation and constants in the same file, reads Next.js development-only values as in production, knows helmet's defaults, and skips test files that assert on sample headers. The strict policy from web.dev and the nonce examples from the Next.js CSP guide are not flagged. It never runs your code and never fetches your site. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• C01: script sources that allow any host: *, https:, http:, data:, or a wildcard over a top-level domain (fine only with 'strict-dynamic' and a nonce or hash)
• C02: a policy the browser reads differently from what is written: keywords, nonces or hashes without single quotes, hosts in quotes, directive names with typos, underscores, camelCase or a colon, missing semicolons, commas between sources, a meta tag after the body tag
• C03: a fixed nonce written into a config file, meta tag or code string

REVIEW (check before release)

• C11: 'unsafe-inline' for scripts without a nonce, hash or 'strict-dynamic'
• C12: 'unsafe-eval' for scripts
• C13: no object-src or default-src, or object-src open to any host
• C14: a nonce-based policy without base-uri, or base-uri open to any host
• C15: a header policy without frame-ancestors when the same file sets no X-Frame-Options
• C16: parts that are not enforced: only a Report-Only header, Report-Only, frame-ancestors, report-uri or sandbox in a meta tag, a directive written twice, removed directives such as plugin-types
• C17: script hosts that can be used to bypass a host list: JSONP and AngularJS hosts (also through wildcards such as *.googletagmanager.com), public package CDNs unless the source names one package or file (cdn.jsdelivr.net/npm/ allows every package), wildcards over shared hosting such as *.cloudfront.net
• C18: a policy that restricts images, styles or connections but not scripts
• C19: a misspelled keyword such as 'unsafe-inlne' or 'slef', which browsers ignore (the report names the keyword it is closest to)

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and official source for each rule
• A risky and a safe example site (nginx, HTML, _headers, vercel.json, Express with helmet, Caddyfile), and the real report the scanner produces on the risky one

Limits

It reads each file on its own: headers sent by other files, a CDN, a proxy or the framework are not known, so a missing frame-ancestors can be reported when X-Frame-Options is set elsewhere. Policies built at run time (from environment variables, a database or helper functions), Rails' content_security_policy block, and SvelteKit or Astro CSP config are not read, and nginx include and map are not followed. Nonces are judged by how they are written, not by how the server makes them. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 21 files: SKILL.md, the scanner in scripts/ (6 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (12 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.