تشغيل أي مهارة في Manus بنقرة واحدة

astro-security

النجوم٠

التفرعات٠

آخر تحديث١٠ مايو ٢٠٢٦ في ١٠:٣٠

Use when configuring Content Security Policy (CSP) in Astro 6, setting security headers, managing script/style hashes, using nonces, or implementing experimentalStaticHeaders for adapter deployments.

التثبيت

التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.

تشغيل في Manus

المصدر

fusengine

fusengine/codex-agent

فتح مستودع GitHub عرض مستودعات المنشئ

تنزيل

تشغيل في Manus

المهن ذات الصلةSOC

استنادا إلى تصنيف SOC المهني

مطوّرو البرمجياتمهن الحاسوب والرياضيات·SOC 15-1252

مستكشف الملفات

9 ملفات

SKILL.md

readonly

name	astro-security
description	Use when configuring Content Security Policy (CSP) in Astro 6, setting security headers, managing script/style hashes, using nonces, or implementing experimentalStaticHeaders for adapter deployments.

Astro Security

Agent Workflow (MANDATORY)

Before ANY implementation, use TeamCreate to spawn 3 agents:

fuse-ai-pilot:explore-codebase - Analyze existing security config, adapters, headers
fuse-ai-pilot:research-expert - Verify latest Astro 6 CSP docs via Context7/Exa
mcp__context7__query-docs - Check CSP compatibility with deployment adapter

After implementation, run fuse-ai-pilot:sniper for validation.

Overview

When to Use

Enabling CSP in an Astro 6 project (stable in v6.0.0)
Configuring security.csp in astro.config.mjs
Adding SHA-256/384/512 hashes for external scripts or styles
Using nonces for dynamic script injection
Setting up experimentalStaticHeaders for adapter-based CSP headers

CSP in Astro 6

Astro 6 ships Content Security Policy as a stable feature (previously experimental). When enabled:

Astro automatically generates SHA hashes for all bundled scripts and styles
Injects a <meta http-equiv="content-security-policy"> in each page's <head>
Supports script-src and style-src directives by default

Limitations:

Not supported in dev mode — test with build + preview
External scripts and styles require manual hash configuration
Incompatible with <ClientRouter /> view transitions (use native View Transition API)
Shiki syntax highlighter (inline styles) not currently supported

Reference Guide

Concepts

Topic	Reference	When to Consult
CSP overview	csp-overview.md	Understanding CSP in Astro 6
Configuration	csp-config.md	All config options
Script directive	script-directive.md	script-src configuration
Style directive	style-directive.md	style-src configuration
Nonces	nonces.md	Dynamic script injection
Static headers	static-headers.md	Adapter-based CSP headers

Templates

Template	When to Use
csp-basic.md	Basic CSP enable with algorithm
csp-advanced.md	Full config with directives + static headers

Best Practices

Always test with build + preview — CSP is inactive in dev mode
Start with SHA-512 — strongest hash algorithm
Use 'self' explicitly — not included by default in resources
Hash external scripts manually — compute SHA hashes for CDN resources
Combine with adapter headers — use experimentalStaticHeaders for Vercel/Netlify

Forbidden

Testing CSP in dev mode (doesn't work — always use build + preview)
Using <ClientRouter /> with CSP enabled
Forgetting to add 'self' when using resources array
Adding unsafe-inline (defeats purpose of CSP)

المزيد من هذا المستودع

نفس المستودع

impeccable

fusengine/codex-agent

Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, or colorize a frontend interface. Covers websites, landing pages, dashboards, product UI, components, forms, onboarding, empty states. Handles UX review, hierarchy, accessibility, responsive behavior, theming, typography, layout, color, motion, UX copy, design tokens. Also bolder/quieter redesigns, live browser iteration, ambitious visual effects.

2026-05-100

agent-creator

fusengine/codex-agent

Use when creating expert agents. Generates agent.md with frontmatter, hooks, required sections, and skill references.

2026-05-100

apex-methodology

fusengine/codex-agent

Systematic development workflow: Analyze → Plan → Execute → eLicit → eXamine. Use for ANY development task: features, bug fixes, refactoring, hotfixes. Triggers: "implement", "create", "build", "fix", "add feature", "refactor", "develop". Auto-detects project type (Laravel, Next.js, React, Swift) and loads framework-specific references. Enforces: files <100 lines, interfaces separated, SOLID principles, expert self-review, sniper validation.

2026-05-100

brainstorming

fusengine/codex-agent

Use when user requests creative work - creating features, building components, adding functionality, or modifying behavior. Activates BEFORE APEX Analyze phase to refine requirements through structured questioning.

2026-05-100

code-quality

fusengine/codex-agent

Code quality validation with linters, SOLID principles, DRY detection, error detection, and architecture compliance across all languages.

2026-05-100

elicitation

fusengine/codex-agent

Auto-review skill for expert agents. After coding, expert applies elicitation techniques to self-correct before sniper validation. Inspired by BMAD-METHOD.

2026-05-100

name	astro-security
description	Use when configuring Content Security Policy (CSP) in Astro 6, setting security headers, managing script/style hashes, using nonces, or implementing experimentalStaticHeaders for adapter deployments.

Astro Security

Agent Workflow (MANDATORY)

Before ANY implementation, use TeamCreate to spawn 3 agents:

fuse-ai-pilot:explore-codebase - Analyze existing security config, adapters, headers
fuse-ai-pilot:research-expert - Verify latest Astro 6 CSP docs via Context7/Exa
mcp__context7__query-docs - Check CSP compatibility with deployment adapter

After implementation, run fuse-ai-pilot:sniper for validation.

Overview

When to Use

Enabling CSP in an Astro 6 project (stable in v6.0.0)
Configuring security.csp in astro.config.mjs
Adding SHA-256/384/512 hashes for external scripts or styles
Using nonces for dynamic script injection
Setting up experimentalStaticHeaders for adapter-based CSP headers

CSP in Astro 6

Astro 6 ships Content Security Policy as a stable feature (previously experimental). When enabled:

Astro automatically generates SHA hashes for all bundled scripts and styles
Injects a <meta http-equiv="content-security-policy"> in each page's <head>
Supports script-src and style-src directives by default

Limitations:

Not supported in dev mode — test with build + preview
External scripts and styles require manual hash configuration
Incompatible with <ClientRouter /> view transitions (use native View Transition API)
Shiki syntax highlighter (inline styles) not currently supported

Reference Guide

Concepts

Topic	Reference	When to Consult
CSP overview	csp-overview.md	Understanding CSP in Astro 6
Configuration	csp-config.md	All config options
Script directive	script-directive.md	script-src configuration
Style directive	style-directive.md	style-src configuration
Nonces	nonces.md	Dynamic script injection
Static headers	static-headers.md	Adapter-based CSP headers

Templates

Template	When to Use
csp-basic.md	Basic CSP enable with algorithm
csp-advanced.md	Full config with directives + static headers

Best Practices

Always test with build + preview — CSP is inactive in dev mode
Start with SHA-512 — strongest hash algorithm
Use 'self' explicitly — not included by default in resources
Hash external scripts manually — compute SHA hashes for CDN resources
Combine with adapter headers — use experimentalStaticHeaders for Vercel/Netlify

Forbidden

Testing CSP in dev mode (doesn't work — always use build + preview)
Using <ClientRouter /> with CSP enabled
Forgetting to add 'self' when using resources array
Adding unsafe-inline (defeats purpose of CSP)