sec-headers
Skill0 starsChanged 3 months agoMITView on GitHub
Grades the HTTP security headers of a URL — HSTS, Content-Security-Policy, framing protection (X-Frame-Options/frame-ancestors), X-Content-Type-Options, Referrer-Policy, and cookie Secure/HttpOnly flags — with an A-F letter grade and per-header pass/warn/fail. Stdlib-only fetch, no browser.
In this repository69 other files it gives its agents.
- AGENTS.mdAGENTS.md
- skills/AGENTS.mdAGENTS.md
- skills/ultimate-browsing/engine/AGENTS.mdAGENTS.md
- 3d-designSkill
- algorithmic-artSkill
- api-testerSkill
- apple-suiteSkill
- appshotSkill
- astra-initSkill
- blindspotSkill
- changelog-genSkill
- claim-auditSkill
- code-reviewSkill
- comment-checkerSkill
- context-budgetSkill
- cron-auditSkill
- css-pro-tipsSkill
- designSkill
- diff-reviewSkill
- doc-readerSkill
- domain-modelingSkill
- env-gateSkill
- ext-scaffoldSkill
- gate-graphSkill
- gh-address-commentsSkill
- gh-fix-ciSkill
- git-masterSkill
- graph-toolsSkill
- grillingSkill
- herdrSkill
- image-genSkill
- json-diffSkill
- linus-levelSkill
- log-analyzerSkill
- log-deviationSkill
- lsp-setupSkill
- merge-quizSkill
- nbj-write-clearlySkill
- net-probeSkill
- open-loopsSkill
- portfolio-auditSkill
- pro-reviewSkill
- proxmox-veSkill
- remove-ai-slopsSkill
- repo-auditSkill
- resume-auditSkill
- secret-gateSkill
- seo-auditSkill
- session-finderSkill
- session-handoffSkill
- session-rulesSkill
- skill-auditSkill
- skill-creatorSkill
- skill-decaySkill
- skill-optimizerSkill
- skill-pickerSkill
- skill-syncSkill
- social-researchSkill
- subscription-auditSkill
- sys-healthSkill
- The first 60 shown.
The file
Files
Sec Headers
The security headers browsers enforce, graded in one request.
Commands
python3 scripts/sec_headers.py https://your-app.com
python3 scripts/sec_headers.py https://your-app.com --json --min-grade BChecks
| Header | Missing = |
| Strict-Transport-Security | FAIL (-25): downgrade attacks possible |
| Content-Security-Policy | FAIL (-25): no XSS second line of defense |
| X-Frame-Options or CSP frame-ancestors | WARN (-10): clickjacking possible |
| X-Content-Type-Options | WARN (-10): MIME confusion |
| Referrer-Policy | WARN (-10): URL leakage |
| Cookie Secure/HttpOnly | WARN (-10): session theft surface |
Grade: A ≥90, B ≥75, C ≥60, D ≥40, F below. --min-grade makes it a CI gate.
Pairs with
api-tester (endpoint behavior), secret-gate (credential leaks in the
code behind those headers), net-probe (TLS validity of the connection).
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.