Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.
Purpose
Implement prioritized CIS Controls for Riksdagsmonitor's static HTML/CSS website, focusing on controls applicable to static site hosting on GitHub Pages.
When to Use
✅ Security hardening activities
✅ Compliance assessments
✅ Security baseline establishment
✅ GitHub Pages security configuration
Applicable CIS Controls for Static Sites
Control 1: Inventory and Control of Enterprise Assets
Static Site Context:
GitHub repository (version control)
GitHub Pages hosting infrastructure
DNS records (riksdagsmonitor.com)
CDN endpoints
Implementation:
# Document in ARCHITECTURE.mdAssets:-Repository:Hack23/riksdagsmonitor(GitHub)-Hosting:GitHubPages
CDN
-
Domain:
riksdagsmonitor.com
-
DNS:
GitHub
Pages
DNS
-
Languages:
14
HTML
files
(index.html,
index_sv.html,
etc.)
-
Styles:
styles.css
(107KB)
Control 2: Inventory and Control of Software Assets
Static Site Context:
HTML5, CSS3 (no backend dependencies)
GitHub Actions workflows
MCP servers (local Node.js packages)
Implementation:
// package.json - Track all MCP dependencies{"dependencies":{"riksdag-regering-mcp":"^1.0.0","@modelcontextprotocol/server-filesystem":"latest","@modelcontextprotocol/server-memory":"latest","@playwright/mcp":"latest"}}
Control 3: Data Protection
Static Site Context:
No server-side data storage
No cookies or tracking
External links to CIA platform (HTTPS)
Implementation:
<!-- All links use HTTPS --><ahref="https://www.hack23.com/cia/"rel="noopener noreferrer">CIA Platform</a><!-- No data collection --><!-- No cookies, no analytics, no user tracking --><!-- Security headers configured in GitHub Pages -->
Control 4: Secure Configuration
Static Site Context:
GitHub Pages configuration
Security headers
CSP (Content Security Policy)
Implementation:
# .github/workflows/deploy.ymlname:Deploy# Minimal permissionspermissions:contents:readpages:writeid-token:write# Security headers enforced via GitHub Pages# Additional headers via _headers file (if supported)
# Review GitHub organization members
gh api orgs/Hack23/members --jq '.[] | {login, role}'# Review repository collaborators
gh api repos/Hack23/riksdagsmonitor/collaborators --jq '.[] | {login, permissions}'# Audit access logs
gh api orgs/Hack23/audit-log --jq '.[] | select(.action == "repo.access")'
Control 6: Access Control Management
Static Site Context:
GitHub branch protection
Required reviews
Signed commits
Implementation:
# Branch protection rules for main branchprotections:-required_pull_request_reviews:required_approving_review_count:1-required_signatures:true-enforce_admins:true-restrictions:users: []
teams: ["security-team"]
Control 8: Audit Log Management
Static Site Context:
GitHub audit logs
GitHub Actions logs
Deployment logs
Implementation:
# Query GitHub audit logs
gh api /orgs/Hack23/audit-log \
--jq '.[] | select(.repo == "Hack23/riksdagsmonitor") | {created_at, action, actor}'# Review workflow runs
gh run list --repo Hack23/riksdagsmonitor --limit 100
# Download workflow logs
gh run view <run-id> --log --repo Hack23/riksdagsmonitor
Control 10: Malware Defenses
Static Site Context:
No server-side code execution
GitHub's malware scanning
Dependency scanning
Implementation:
# .github/workflows/security-scanning.ymlname:SecurityScanningon: [push, pull_request]
jobs:scan:runs-on:ubuntu-latestpermissions:security-events:writesteps:-uses:actions/checkout@v4# Scan for malware in committed files-name:MalwareScanneruses:dell/common-github-actions/malware-scanner@main# CodeQL for any JavaScript-name:CodeQLAnalysisuses:github/codeql-action/init@v3with:languages:javascript-name:PerformCodeQLAnalysisuses:github/codeql-action/analyze@v3
Control 11: Data Recovery
Static Site Context:
Git version history
GitHub repository backups
No dynamic data to backup
Implementation:
# Backup repository (automated via git)
git clone --mirror https://github.com/Hack23/riksdagsmonitor.git
tar -czf riksdagsmonitor-backup-$(date +%Y%m%d).tar.gz riksdagsmonitor.git
# Restore from backup
git clone riksdagsmonitor.git riksdagsmonitor-restored
cd riksdagsmonitor-restored
git remote set-url origin https://github.com/Hack23/riksdagsmonitor.git
