Comprehensive Content Security Policy audit for MCP Apps in sandboxed iframes. Discovers all network origins, traces them to source, and generates CSP configuration for registerAppResource.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Comprehensive Content Security Policy audit for MCP Apps in sandboxed iframes. Discovers all network origins, traces them to source, and generates CSP configuration for registerAppResource.
Perform exhaustive Content Security Policy audits for MCP Apps running in sandboxed iframes where all network requests fail SILENTLY without proper CSP declarations.
Overview
MCP Apps run in sandboxed iframes with no same-origin server. This means:
ALL network requests fail silently without CSP -- no errors, no warnings, just silent failure
Every external origin (CDN, API, font, image, WebSocket) must be declared in CSP
CSP is configured in the contents[] return from the registerAppResource read callback
Missing even ONE origin causes that resource to silently not load
This skill provides a systematic methodology for discovering every network origin an app uses, tracing each to its source, and generating the correct CSP configuration.
Capabilities
Build Output Analysis
Build the application and capture all output files (HTML, CSS, JS, assets)
Search every file for network origin references
Identify fetch/XHR targets, script sources, link hrefs, image sources, font URLs, iframe sources, WebSocket endpoints
Origin Tracing
Trace each discovered origin to its source in the codebase
Classify as: hardcoded constant, environment variable, or conditional logic
Document whether origin is universal, dev-only, or prod-only
connectDomains: fetch/XHR targets, WebSocket endpoints (maps to connect-src)
frameDomains: Nested iframes (maps to frame-src)
CSP Configuration Generation
Generate the CSP object for registerAppResource read callback
Handle environment-specific origins with proper conditional logic
Verify conditional origins have matching runtime URL and CSP entry
Usage
Step 1: Build the Application
# Build to produce final output files
npm run build
# Identify all output files
find dist/ -type f \( -name "*.html" -o -name "*.js" -o -name "*.css" \)
Step 2: Search for ALL Network Origins
# Search for URL patterns in build output
grep -rEoh 'https?://[a-zA-Z0-9._-]+[a-zA-Z0-9._/-]*' dist/ | sort -u
# Search for protocol-relative URLs
grep -rEoh '//[a-zA-Z0-9._-]+\.[a-zA-Z]{2,}' dist/ | sort -u
# Search for fetch/XHR patterns in source
grep -rn 'fetch\|XMLHttpRequest\|axios\|\.get\(\|\.post\(' src/
# Search for WebSocket connections
grep -rn 'new WebSocket\|wss://\|ws://' src/
# Search for dynamic imports and lazy loading
grep -rn 'import(\|require(\|loadScript' src/
