Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

astro-security

Étoiles0

Forks0

Mis à jour10 mai 2026 à 10:30

Use when configuring Content Security Policy (CSP) in Astro 6, setting security headers, managing script/style hashes, using nonces, or implementing experimentalStaticHeaders for adapter deployments.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

fusengine

fusengine/codex-agent

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Développeurs de logicielsProfessions informatiques et mathématiques·SOC 15-1252

Explorateur de fichiers

9 fichiers

SKILL.md

readonly

name	astro-security
description	Use when configuring Content Security Policy (CSP) in Astro 6, setting security headers, managing script/style hashes, using nonces, or implementing experimentalStaticHeaders for adapter deployments.

Astro Security

Agent Workflow (MANDATORY)

Before ANY implementation, use TeamCreate to spawn 3 agents:

fuse-ai-pilot:explore-codebase - Analyze existing security config, adapters, headers
fuse-ai-pilot:research-expert - Verify latest Astro 6 CSP docs via Context7/Exa
mcp__context7__query-docs - Check CSP compatibility with deployment adapter

After implementation, run fuse-ai-pilot:sniper for validation.

Overview

When to Use

Enabling CSP in an Astro 6 project (stable in v6.0.0)
Configuring security.csp in astro.config.mjs
Adding SHA-256/384/512 hashes for external scripts or styles
Using nonces for dynamic script injection
Setting up experimentalStaticHeaders for adapter-based CSP headers

CSP in Astro 6

Astro 6 ships Content Security Policy as a stable feature (previously experimental). When enabled:

Astro automatically generates SHA hashes for all bundled scripts and styles
Injects a <meta http-equiv="content-security-policy"> in each page's <head>
Supports script-src and style-src directives by default

Limitations:

Not supported in dev mode — test with build + preview
External scripts and styles require manual hash configuration
Incompatible with <ClientRouter /> view transitions (use native View Transition API)
Shiki syntax highlighter (inline styles) not currently supported

Reference Guide

Concepts

Topic	Reference	When to Consult
CSP overview	csp-overview.md	Understanding CSP in Astro 6
Configuration	csp-config.md	All config options
Script directive	script-directive.md	script-src configuration
Style directive	style-directive.md	style-src configuration
Nonces	nonces.md	Dynamic script injection
Static headers	static-headers.md	Adapter-based CSP headers

Templates

Template	When to Use
csp-basic.md	Basic CSP enable with algorithm
csp-advanced.md	Full config with directives + static headers

Best Practices

Always test with build + preview — CSP is inactive in dev mode
Start with SHA-512 — strongest hash algorithm
Use 'self' explicitly — not included by default in resources
Hash external scripts manually — compute SHA hashes for CDN resources
Combine with adapter headers — use experimentalStaticHeaders for Vercel/Netlify

Forbidden

Testing CSP in dev mode (doesn't work — always use build + preview)
Using <ClientRouter /> with CSP enabled
Forgetting to add 'self' when using resources array
Adding unsafe-inline (defeats purpose of CSP)

Plus depuis ce dépôt

même dépôt

impeccable

fusengine/codex-agent

Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, or colorize a frontend interface. Covers websites, landing pages, dashboards, product UI, components, forms, onboarding, empty states. Handles UX review, hierarchy, accessibility, responsive behavior, theming, typography, layout, color, motion, UX copy, design tokens. Also bolder/quieter redesigns, live browser iteration, ambitious visual effects.

2026-05-100

agent-creator

fusengine/codex-agent

Use when creating expert agents. Generates agent.md with frontmatter, hooks, required sections, and skill references.

2026-05-100

apex-methodology

fusengine/codex-agent

Systematic development workflow: Analyze → Plan → Execute → eLicit → eXamine. Use for ANY development task: features, bug fixes, refactoring, hotfixes. Triggers: "implement", "create", "build", "fix", "add feature", "refactor", "develop". Auto-detects project type (Laravel, Next.js, React, Swift) and loads framework-specific references. Enforces: files <100 lines, interfaces separated, SOLID principles, expert self-review, sniper validation.

2026-05-100

brainstorming

fusengine/codex-agent

Use when user requests creative work - creating features, building components, adding functionality, or modifying behavior. Activates BEFORE APEX Analyze phase to refine requirements through structured questioning.

2026-05-100

code-quality

fusengine/codex-agent

Code quality validation with linters, SOLID principles, DRY detection, error detection, and architecture compliance across all languages.

2026-05-100

elicitation

fusengine/codex-agent

Auto-review skill for expert agents. After coding, expert applies elicitation techniques to self-correct before sniper validation. Inspired by BMAD-METHOD.

2026-05-100

name	astro-security
description	Use when configuring Content Security Policy (CSP) in Astro 6, setting security headers, managing script/style hashes, using nonces, or implementing experimentalStaticHeaders for adapter deployments.

Astro Security

Agent Workflow (MANDATORY)

Before ANY implementation, use TeamCreate to spawn 3 agents:

fuse-ai-pilot:explore-codebase - Analyze existing security config, adapters, headers
fuse-ai-pilot:research-expert - Verify latest Astro 6 CSP docs via Context7/Exa
mcp__context7__query-docs - Check CSP compatibility with deployment adapter

After implementation, run fuse-ai-pilot:sniper for validation.

Overview

When to Use

Enabling CSP in an Astro 6 project (stable in v6.0.0)
Configuring security.csp in astro.config.mjs
Adding SHA-256/384/512 hashes for external scripts or styles
Using nonces for dynamic script injection
Setting up experimentalStaticHeaders for adapter-based CSP headers

CSP in Astro 6

Astro 6 ships Content Security Policy as a stable feature (previously experimental). When enabled:

Astro automatically generates SHA hashes for all bundled scripts and styles
Injects a <meta http-equiv="content-security-policy"> in each page's <head>
Supports script-src and style-src directives by default

Limitations:

Not supported in dev mode — test with build + preview
External scripts and styles require manual hash configuration
Incompatible with <ClientRouter /> view transitions (use native View Transition API)
Shiki syntax highlighter (inline styles) not currently supported

Reference Guide

Concepts

Topic	Reference	When to Consult
CSP overview	csp-overview.md	Understanding CSP in Astro 6
Configuration	csp-config.md	All config options
Script directive	script-directive.md	script-src configuration
Style directive	style-directive.md	style-src configuration
Nonces	nonces.md	Dynamic script injection
Static headers	static-headers.md	Adapter-based CSP headers

Templates

Template	When to Use
csp-basic.md	Basic CSP enable with algorithm
csp-advanced.md	Full config with directives + static headers

Best Practices

Always test with build + preview — CSP is inactive in dev mode
Start with SHA-512 — strongest hash algorithm
Use 'self' explicitly — not included by default in resources
Hash external scripts manually — compute SHA hashes for CDN resources
Combine with adapter headers — use experimentalStaticHeaders for Vercel/Netlify

Forbidden

Testing CSP in dev mode (doesn't work — always use build + preview)
Using <ClientRouter /> with CSP enabled
Forgetting to add 'self' when using resources array
Adding unsafe-inline (defeats purpose of CSP)