| name | http-sec-audit |
| description | Audit a website's HTTP security headers and cookie flags — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP, version-leaking banners, and Secure/HttpOnly/SameSite cookies. Use when the user asks to "check my site's security headers", "audit HTTP headers", "is my CSP/HSTS configured right", or "scan a URL for header misconfigs". |
| license | MIT |
HTTP Security Header Audit
Checks a site's response headers against modern web-security best practices and
returns prioritized findings with concrete fixes. The analysis core is pure and
offline-testable; live scanning uses only Python's stdlib urllib.
When to use this skill
- "Audit the security headers on https://example.com."
- "Is my CSP / HSTS / cookie config correct?"
- "Why is this site flagged for missing headers?"
What it checks
- Content-Security-Policy — presence,
unsafe-inline, wildcards.
- Strict-Transport-Security — presence and
max-age length.
- X-Content-Type-Options: nosniff, X-Frame-Options /
frame-ancestors.
- Referrer-Policy, Permissions-Policy.
- Information disclosure —
Server / X-Powered-By version banners.
- Cookies —
Secure, HttpOnly, SameSite (incl. SameSite=None
without Secure).
How to run it
python skills/http-sec-audit/audit.py https://example.com
python skills/http-sec-audit/audit.py https://example.com --json
python skills/http-sec-audit/audit.py --headers-file response_headers.txt
Exit codes: 0 no high issues · 1 findings present · 2 fetch/usage error.
Recommended workflow for Claude
- Run the audit (live, or offline against captured headers).
- Group findings by severity and present each with its one-line fix.
- Offer ready-to-paste header snippets for the user's stack (nginx, Apache,
Express, etc.) for the missing headers.
- Only scan sites the user owns or is authorized to test.
