メニュー
Use when configuring Content Security Policy (CSP) in Astro 7, setting security headers, managing script/style hashes, using nonces, or implementing experimentalStaticHeaders for adapter deployments.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Core design method — Register resolution (brand vs product), the Design Read one-liner + the 3 dials (DESIGN_VARIANCE/VISUAL_DENSITY/MOTION_INTENSITY), the Gate 0 brief lock, Absolute bans, the 2-level AI-slop test, and routing to a move (generate/critique/audit/bolder/quieter/distill/harden/polish) and its target skill. Read this first, before design-system, any register/*.md, or any moves/*.md file.
Motion pass on a settled layout — the animation-decision gate, transform/opacity-first materials, the 100/300/500 duration scale, exponential/emphasized easing (no bounce), mandatory reduced-motion, and the AI-motion-signature ban.
Token-strategy core — OKLCH color rules, neutral tinting, accent-commitment levels, type scale, 8pt spacing grid, touch targets, and the canonical output format of design-system.md (the file the harness gates on). This is routing step 1 of design-method/SKILL.md — read it before design-web/design-webapp/design-ios/design-android, before picking or auditing a single color/type/spacing value.
Marketing sites, landing pages, campaign pages — register `brand` (design IS the product). Structure comes from the register's POV + a macrostructure pick, never from copying an inspiration site's section flow. Hero discipline, deviated section order, asymmetric grids, and a silhouette lookalike-test gate before ship.
Android mockups and handoff specs — Material 3 Expressive type scale (baseline + emphasized), full color-role system (45 roles incl. surface-container ramp + dynamic color), elevation tokens, shape scale, window size classes, FAB tiers, motion, device-framed HTML mockup, and a Compose-ready handoff spec. Produces tokens + mockup only, never Compose code.
iOS + macOS mockups and handoff specs — Dynamic Type scale, semantic colors, device viewports, Liquid Glass, macOS text/window/pointer conventions, device-framed HTML mockup, and a SwiftUI-ready handoff spec. Produces tokens + mockup only, never SwiftUI code.
| name | astro-security |
| description | Use when configuring Content Security Policy (CSP) in Astro 7, setting security headers, managing script/style hashes, using nonces, or implementing experimentalStaticHeaders for adapter deployments. |
| versions | {"astro":"7"} |
| user-invocable | true |
| references | references/csp-overview.md, references/csp-config.md, references/script-directive.md, references/style-directive.md, references/nonces.md, references/static-headers.md, references/templates/csp-basic.md, references/templates/csp-advanced.md |
| related-skills | astro-7, astro-deployment, solid-astro |
Before ANY implementation, use TeamCreate to spawn 3 agents:
After implementation, run fuse-ai-pilot:sniper for validation.
security.csp in astro.config.mjsexperimentalStaticHeaders for adapter-based CSP headersAstro 6 ships Content Security Policy as a stable feature (previously experimental). When enabled:
<meta http-equiv="content-security-policy"> in each page's <head>script-src and style-src directives by defaultLimitations:
dev mode — test with build + preview<ClientRouter /> view transitions (use native View Transition API)| Topic | Reference | When to Consult |
|---|---|---|
| CSP overview | csp-overview.md | Understanding CSP in Astro |
| Configuration | csp-config.md | All config options |
| Script directive | script-directive.md | script-src configuration |
| Style directive | style-directive.md | style-src configuration |
| Nonces | nonces.md | Dynamic script injection |
| Static headers | static-headers.md | Adapter-based CSP headers |
| Template | When to Use |
|---|---|
| csp-basic.md | Basic CSP enable with algorithm |
| csp-advanced.md | Full config with directives + static headers |
'self' explicitly — not included by default in resourcesexperimentalStaticHeaders for Vercel/Netlifydev mode (doesn't work — always use build + preview)<ClientRouter /> with CSP enabled'self' when using resources arrayunsafe-inline (defeats purpose of CSP)