📦
dead-code-detector
79Find Dead Code Before Cleanup
Unused code slows reviews and increases maintenance risk. This skill helps Claude, Codex, and Claude Code identify removal candidates with review guidance.
Coding & Development View
Skills security-headers
📦
security-headers
Content revision r1 Safe ⚙️ External commands🌐 Network access
Audit HTTP Security Headers
Missing or weak browser headers expose web apps to common client-side attacks. This skill audits headers and gives implementation guidance for safer deployments.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "security-headers" from https://skillstore.io/skills/curiouslearner-security-headers.md and its manifest at https://skillstore.io/api/skills/curiouslearner-security-headers/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "security-headers". A web app has no Content Security Policy and no HSTS header.
Expected outcome:
- Overall grade: high risk because browser-side protections are incomplete.
- Top fixes: add HSTS after HTTPS validation, then deploy CSP in report-only mode.
- Validation: confirm redirects, check browser console violations, and re-scan headers after deployment.
Using "security-headers". An API returns wildcard CORS with credentials enabled.
Expected outcome:
- Finding: wildcard CORS with credentials can expose authenticated data to untrusted origins.
- Recommendation: allow only trusted origins and reject unexpected Origin values.
- Deployment note: test partner integrations before enforcing the allowlist.
Using "security-headers". A team needs a staged rollout for a strict Content Security Policy.
Expected outcome:
- Start with report-only mode and collect violations for one week.
- Replace unsafe inline scripts with nonces or hashes before enforcement.
- Move to enforcement after critical user flows pass browser testing.
Security Audit
Safev8 • 7/6/2026 Open versioned report
Static analysis flagged Markdown backticks, example URLs, attack demonstrations, and placeholder certificate paths in SKILL.md. Context review found documentation and configuration examples, not executable code. No hidden network behavior, credential access, prompt injection, or bundled secrets were found.
1
Files scanned
1,048
Lines analyzed
0
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (147)
SKILL.md:51-53 SKILL.md:53-56 SKILL.md:56-57 SKILL.md:57-58 SKILL.md:58-59 SKILL.md:59-60 SKILL.md:60-61 SKILL.md:61-62 SKILL.md:62-63 SKILL.md:63-64 SKILL.md:64-65 SKILL.md:65-70 SKILL.md:70-72 SKILL.md:72-75 SKILL.md:75-76 SKILL.md:76-77 SKILL.md:77-82 SKILL.md:82-84 SKILL.md:84-87 SKILL.md:87-88 SKILL.md:88-89 SKILL.md:89-94 SKILL.md:94-96 SKILL.md:96-101 SKILL.md:101-103 SKILL.md:103-110 SKILL.md:110-112 SKILL.md:112-115 SKILL.md:115-116 SKILL.md:116-117 SKILL.md:117-118 SKILL.md:118-119 SKILL.md:119-120 SKILL.md:120-121 SKILL.md:121-122 SKILL.md:122-127 SKILL.md:127-129 SKILL.md:129-134 SKILL.md:134-136 SKILL.md:136-139 SKILL.md:139-141 SKILL.md:141-144 SKILL.md:144-146 SKILL.md:146-150 SKILL.md:150-157 SKILL.md:157-162 SKILL.md:162-174 SKILL.md:174-177 SKILL.md:177-183 SKILL.md:183-186 SKILL.md:186-192 SKILL.md:192-196 SKILL.md:196-240 SKILL.md:240-242 SKILL.md:242-254 SKILL.md:254-256 SKILL.md:256-269 SKILL.md:269-271 SKILL.md:271-293 SKILL.md:293-302 SKILL.md:302-305 SKILL.md:305-307 SKILL.md:307-312 SKILL.md:312-329 SKILL.md:329-332 SKILL.md:332-334 SKILL.md:334-337 SKILL.md:337-339 SKILL.md:339-342 SKILL.md:342-351 SKILL.md:351-370 SKILL.md:370-375 SKILL.md:375-378 SKILL.md:378-380 SKILL.md:380-385 SKILL.md:385-391 SKILL.md:391-394 SKILL.md:394-396 SKILL.md:396-399 SKILL.md:399-401 SKILL.md:401-409 SKILL.md:409-415 SKILL.md:415-439 SKILL.md:439-441 SKILL.md:441-446 SKILL.md:446-453 SKILL.md:453-456 SKILL.md:456-458 SKILL.md:458-461 SKILL.md:461-467 SKILL.md:467-478 SKILL.md:478-480 SKILL.md:480-483 SKILL.md:483-488 SKILL.md:488-491 SKILL.md:491-492 SKILL.md:492-493 SKILL.md:493-504 SKILL.md:504-506 SKILL.md:506-520 SKILL.md:520-523 SKILL.md:523-529 SKILL.md:529-542 SKILL.md:542-545 SKILL.md:545-560 SKILL.md:560-563 SKILL.md:563-580 SKILL.md:580-583 SKILL.md:583-593 SKILL.md:593-604 SKILL.md:604-606 SKILL.md:606-613 SKILL.md:613-625 SKILL.md:625-652 SKILL.md:652-658 SKILL.md:658-669 SKILL.md:669-674 SKILL.md:674-685 SKILL.md:685-695 SKILL.md:695-706 SKILL.md:706-712 SKILL.md:712-715 SKILL.md:715-723 SKILL.md:723-731 SKILL.md:731-733 SKILL.md:733-739 SKILL.md:739-746 SKILL.md:746-758 SKILL.md:758-760 SKILL.md:760-765 SKILL.md:765-767 SKILL.md:767-770 SKILL.md:770-776 SKILL.md:776-784 SKILL.md:784-786 SKILL.md:786-796 SKILL.md:796-800 SKILL.md:800-808 SKILL.md:808-811 SKILL.md:811-821 SKILL.md:821-837 SKILL.md:837-894 SKILL.md:894-897 SKILL.md:897-938 SKILL.md:938-969 SKILL.md:969-985 SKILL.md:985-1034
🌐 Network access (49)
SKILL.md:297 SKILL.md:531 SKILL.md:537 SKILL.md:654 SKILL.md:687 SKILL.md:52 SKILL.md:152 SKILL.md:164 SKILL.md:167 SKILL.md:170 SKILL.md:173 SKILL.md:179 SKILL.md:182 SKILL.md:188 SKILL.md:191 SKILL.md:199 SKILL.md:297 SKILL.md:300 SKILL.md:306 SKILL.md:322 SKILL.md:333 SKILL.md:338 SKILL.md:371 SKILL.md:410 SKILL.md:466 SKILL.md:531 SKILL.md:537 SKILL.md:548 SKILL.md:549 SKILL.md:585 SKILL.md:654 SKILL.md:657 SKILL.md:670 SKILL.md:687 SKILL.md:693 SKILL.md:711 SKILL.md:717 SKILL.md:718 SKILL.md:721 SKILL.md:722 SKILL.md:741 SKILL.md:744 SKILL.md:772 SKILL.md:841 SKILL.md:875 SKILL.md:910 SKILL.md:921 SKILL.md:928 SKILL.md:936
No confirmed security findings were detected by the latest completed static and semantic audit. This does not prove the skill has no side effects.
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/curiouslearner-security-headers/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/curiouslearner-security-headers?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/curiouslearner-security-headers?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/curiouslearner-security-headers/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/curiouslearner-security-headers.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
CuriousLearner. (2026). security-headers security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/curiouslearner-security-headers/audits/8BibTeX citation
@techreport{curiouslearner-curiouslearner-security-headers-2026,
author = {CuriousLearner},
title = {security-headers security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/curiouslearner-security-headers/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "security-headers security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "CuriousLearner"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/curiouslearner-security-headers/audits/8"
identifiers:
- type: other
value: "skillstore:curiouslearner-security-headers:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
87
Content
73
Community
70
Spec Compliance
What You Can Build
Review a Launch Checklist
Assess whether a new web app has the essential browser security headers before release.
Harden Existing Infrastructure
Turn weak CSP, HSTS, and CORS settings into a prioritized remediation plan.
Prepare Security Evidence
Generate a readable header report for audits, vendor reviews, or internal risk tracking.
Try These Prompts
Basic Header Review
Audit these HTTP response headers. Identify missing security headers, explain the risk, and list the top fixes first.
CSP Improvement Plan
Review this Content Security Policy. Find unsafe directives, explain browser impact, and suggest a safer staged rollout plan.
CORS and HSTS Check
Analyze these CORS and HSTS settings. Flag dangerous combinations and recommend settings for a production web application.
Full Deployment Report
Create a full security headers report for this application. Include severity, business impact, deployment risk, validation steps, and owner-ready remediation tasks.
Best Practices
- Audit real response headers from the same environment that users access.
- Roll out CSP and HSTS in stages with monitoring and rollback plans.
- Re-test headers after proxy, CDN, framework, or authentication changes.
Avoid
- Do not copy example domains or policies into production without review.
- Do not use wildcard CORS with credentials for authenticated APIs.
- Do not enforce a strict CSP before testing critical application flows.
Frequently Asked Questions
Can this skill scan a live website?
Yes, when the user provides an authorized target and the environment permits network access.
Does it write configuration files automatically?
No. It provides guidance and examples that a maintainer should review before applying.
Which headers does it focus on?
It focuses on CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and CORS.
Can it help with compliance reviews?
Yes. It can produce readable findings and remediation notes for security and compliance evidence.
Will the recommendations work for every browser?
No. Browser support varies, so teams should test modern and required legacy browsers.
Is this enough to secure a web application?
No. Security headers reduce browser risks, but they are only one part of application security.
Developer Details
Author
CuriousLearnerLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
d11af420e07cd866fe39cfa937efef3223896c06
Maintenance freshness
7/18/2026
Usage
5 downloads · 380 views
File structure
📄 SKILL.md
More from CuriousLearner
View all📦
code-reviewer
78Review Code for Quality and Security
Code reviews can miss security, testing, and maintainability issues when reviewers lack time. This skill guides Claude, Codex, and Claude Code through a structured review with prioritized findings.
Coding & Development View
📦
refactor-assistant
78Refactor Code Safely with Structured Guidance
Refactoring can introduce bugs when changes are broad or poorly explained. This skill helps Claude, Codex, and Claude Code plan and apply safer incremental improvements.
Coding & Development View
📦
performance-profiler
78Profile Application Performance Bottlenecks
Slow code can hide inside algorithms, rendering, database queries, and bundles. This skill reviews source patterns and produces prioritized optimization guidance.
Coding & Development View
📦
dependency-updater
78Audit Dependency Updates Safely
Dependency updates can hide breaking changes and security urgency. This skill reviews project manifests, summarizes update risk, and recommends an order for safe upgrades.
DevOps & Infrastructure View
📦
log-analyzer
78Analyze Application Logs Faster
Log files hide service failures, error spikes, and slow requests. This skill turns raw logs into structured findings, timelines, and practical remediation guidance.
DevOps & Infrastructure View
Related Skills
View all📦
check-my-vibe
78Audit Your Website Security Posture
by daanaagua
Public websites can expose weak headers, secrets, source maps, and deployment mistakes. This skill guides an authorized Check My Vibe scan and converts evidence into prioritized fixes.
Security & Compliance View
📦
frontend-security-coder
78Build Secure Frontend Applications
by sickn33
Client-side vulnerabilities can expose users through unsafe rendering, navigation, and browser integrations. This skill provides practical guidance for secure frontend implementation and verification.
Security & Compliance View
📦
universal-audit
92Audit Software Releases with Evidence
by glenskii
Release decisions often rely on incomplete evidence and inconsistent standards. This skill applies structured controls, deterministic scoring, and mandatory gates to assess readiness.
Security & Compliance View
📦
python-web-app-security-audit
90Audit Python Web Apps Before Release
by glenskii
Python teams need repeatable checks for common application security controls. This skill provides configurable pytest coverage with clear evidence, boundaries, and release decisions.
Security & Compliance View
📦
information-security-manager-iso27001
84Build an ISO 27001 Information Security Program
by davila7
HealthTech and MedTech teams need structured security governance that aligns operational risks with ISO 27001 requirements. This skill guides ISMS design, risk assessment, control selection, compliance monitoring, and certification preparation.
Security & Compliance View
📦
risk-management-specialist
84Manage Medical Device Risk Files
by alirezarezvani
Medical device teams need consistent risk management evidence across design, regulatory, and post-market work. This skill guides ISO 14971 planning, analysis, controls, and file maintenance.
Security & Compliance View