analyzing-security-headers

Analyze HTTP security headers of web domains to identify vulnerabilities and misconfigurations. Use when you need to audit website security headers, assess header compliance, or get security recommendations for web applications. Trigger with phrases like "analyze security headers", "check HTTP headers", "audit website security headers", or "evaluate CSP and HSTS configuration".

Ir a la instalación

Repositorio: jeremylongshore/claude-code-plugins-plus-skills
Última actividad en el origen: 17 de julio de 2026 a las 22:18
Idioma detectado de SKILL.md: inglés
Estrellas: 2604
Forks: 378

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/jeremylongshore/claude-code-plugins-plus-skills --skill analyzing-security-headers

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

Explorador de archivos

9 archivos

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

clerk-core-workflow-a

Implement user sign-up and sign-in flows with Clerk. Use when building authentication UI, customizing sign-in experience, or implementing OAuth social login. Trigger with phrases like "clerk sign-in", "clerk sign-up", "clerk login flow", "clerk OAuth", "clerk social login".

2026-07-23

clerk-core-workflow-b

Implement session management and middleware with Clerk. Use when managing user sessions, configuring route protection, or implementing token refresh and custom JWT templates. Trigger with phrases like "clerk session", "clerk middleware", "clerk route protection", "clerk token", "clerk JWT".

2026-07-23

clerk-enterprise-rbac

Configure enterprise SSO, role-based access control, and organization management. Use when implementing SSO integration, configuring role-based permissions, or setting up organization-level controls. Trigger with phrases like "clerk SSO", "clerk RBAC", "clerk enterprise", "clerk roles", "clerk permissions", "clerk organizations".

2026-07-23

Ver todos los de este repositorio

Analyzing Security Headers

Overview

Evaluate HTTP response headers for web applications against OWASP Secure Headers Project recommendations and browser security baselines. Identify missing, misconfigured, or information-leaking headers across both HTTP and HTTPS responses.

Prerequisites

Target URL or domain name accessible over the network

Authorization to perform HTTP requests against the target domain

Network connectivity for both HTTP and HTTPS protocols

Optional: write access to ${CLAUDE_SKILL_DIR}/security-reports/ for persisting results

Instructions

Accept the target domain. If only a domain name is provided, default to https://. For batch analysis, accept a newline-separated list.

Fetch response headers using WebFetch for both HTTP and HTTPS endpoints. Record the full redirect chain and final destination URL.

Evaluate critical headers -- flag any that are missing or misconfigured:

Strict-Transport-Security: require max-age>=31536000, includeSubDomains, and preload eligibility
Content-Security-Policy: check for unsafe-inline, unsafe-eval, overly broad default-src, and missing frame-ancestors
X-Frame-Options: require DENY or SAMEORIGIN
X-Content-Type-Options: require nosniff
Permissions-Policy: verify camera, microphone, geolocation restrictions

Evaluate important headers -- report status and recommendations:

Referrer-Policy: recommend strict-origin-when-cross-origin or no-referrer
Cross-Origin-Embedder-Policy (COEP), Cross-Origin-Opener-Policy (COOP), Cross-Origin-Resource-Policy (CORP)

Check for information disclosure -- flag Server, X-Powered-By, X-AspNet-Version, and any header revealing technology stack or version numbers.

Inspect cookie attributes on Set-Cookie headers: verify , , , and / prefix usage.

Analyzing Security Headers

Overview

Prerequisites

Target URL or domain name accessible over the network

Authorization to perform HTTP requests against the target domain

Network connectivity for both HTTP and HTTPS protocols

Optional: write access to ${CLAUDE_SKILL_DIR}/security-reports/ for persisting results

Instructions

Accept the target domain. If only a domain name is provided, default to https://. For batch analysis, accept a newline-separated list.

Fetch response headers using WebFetch for both HTTP and HTTPS endpoints. Record the full redirect chain and final destination URL.

Evaluate critical headers -- flag any that are missing or misconfigured:

Strict-Transport-Security: require max-age>=31536000, includeSubDomains, and preload eligibility
Content-Security-Policy: check for unsafe-inline, unsafe-eval, overly broad default-src, and missing frame-ancestors
X-Frame-Options: require DENY or SAMEORIGIN
X-Content-Type-Options: require nosniff
Permissions-Policy: verify camera, microphone, geolocation restrictions

Evaluate important headers -- report status and recommendations:

Referrer-Policy: recommend strict-origin-when-cross-origin or no-referrer
Cross-Origin-Embedder-Policy (COEP), Cross-Origin-Opener-Policy (COOP), Cross-Origin-Resource-Policy (CORP)

Check for information disclosure -- flag Server, X-Powered-By, X-AspNet-Version, and any header revealing technology stack or version numbers.

Inspect cookie attributes on Set-Cookie headers: verify , , , and / prefix usage.

name	analyzing-security-headers
description	Analyze HTTP security headers of web domains to identify vulnerabilities and misconfigurations. Use when you need to audit website security headers, assess header compliance, or get security recommendations for web applications. Trigger with phrases like "analyze security headers", "check HTTP headers", "audit website security headers", or "evaluate CSP and HSTS configuration".
allowed-tools	Read, WebFetch, WebSearch, Grep
version	1.28.0
author	Jeremy Longshore <jeremy@intentsolutions.io>
license	MIT
tags	["security","compliance","audit"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

name	analyzing-security-headers
description	Analyze HTTP security headers of web domains to identify vulnerabilities and misconfigurations. Use when you need to audit website security headers, assess header compliance, or get security recommendations for web applications. Trigger with phrases like "analyze security headers", "check HTTP headers", "audit website security headers", or "evaluate CSP and HSTS configuration".
allowed-tools	Read, WebFetch, WebSearch, Grep
version	1.28.0
author	Jeremy Longshore <jeremy@intentsolutions.io>
license	MIT
tags	["security","compliance","audit"]
compatibility	Designed for Claude Code, also compatible with Codex and OpenClaw

Error	Cause	Solution
Failed to connect to domain	DNS resolution failure, firewall block, or domain down	Verify domain spelling and DNS records; test alternate protocols
SSL certificate verification failed	Expired, self-signed, or mismatched certificate	Note TLS issue in report; indicates HSTS not properly enforced
Too many redirects	Redirect loop between HTTP and HTTPS	Report the redirect chain and analyze headers at each hop
HTTP 429 Too Many Requests	Rate limiting by target server	Implement backoff; queue domain for delayed re-analysis
Headers differ between HTTP and HTTPS	Inconsistent server configuration	Report both sets; highlight critical differences and flag HSTS gap

analyzing-security-headers

Opciones de instalación

Revisa los archivos de origen