菜单
Use when configuring Content Security Policy (CSP) in Astro 6, setting security headers, managing script/style hashes, using nonces, or implementing experimentalStaticHeaders for adapter deployments.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, or colorize a frontend interface. Covers websites, landing pages, dashboards, product UI, components, forms, onboarding, empty states. Handles UX review, hierarchy, accessibility, responsive behavior, theming, typography, layout, color, motion, UX copy, design tokens. Also bolder/quieter redesigns, live browser iteration, ambitious visual effects.
Use when creating expert agents. Generates agent.md with frontmatter, hooks, required sections, and skill references.
Systematic development workflow: Analyze → Plan → Execute → eLicit → eXamine. Use for ANY development task: features, bug fixes, refactoring, hotfixes. Triggers: "implement", "create", "build", "fix", "add feature", "refactor", "develop". Auto-detects project type (Laravel, Next.js, React, Swift) and loads framework-specific references. Enforces: files <100 lines, interfaces separated, SOLID principles, expert self-review, sniper validation.
Use when user requests creative work - creating features, building components, adding functionality, or modifying behavior. Activates BEFORE APEX Analyze phase to refine requirements through structured questioning.
Code quality validation with linters, SOLID principles, DRY detection, error detection, and architecture compliance across all languages.
Auto-review skill for expert agents. After coding, expert applies elicitation techniques to self-correct before sniper validation. Inspired by BMAD-METHOD.
| name | astro-security |
| description | Use when configuring Content Security Policy (CSP) in Astro 6, setting security headers, managing script/style hashes, using nonces, or implementing experimentalStaticHeaders for adapter deployments. |
Before ANY implementation, use TeamCreate to spawn 3 agents:
After implementation, run fuse-ai-pilot:sniper for validation.
security.csp in astro.config.mjsexperimentalStaticHeaders for adapter-based CSP headersAstro 6 ships Content Security Policy as a stable feature (previously experimental). When enabled:
<meta http-equiv="content-security-policy"> in each page's <head>script-src and style-src directives by defaultLimitations:
dev mode — test with build + preview<ClientRouter /> view transitions (use native View Transition API)| Topic | Reference | When to Consult |
|---|---|---|
| CSP overview | csp-overview.md | Understanding CSP in Astro 6 |
| Configuration | csp-config.md | All config options |
| Script directive | script-directive.md | script-src configuration |
| Style directive | style-directive.md | style-src configuration |
| Nonces | nonces.md | Dynamic script injection |
| Static headers | static-headers.md | Adapter-based CSP headers |
| Template | When to Use |
|---|---|
| csp-basic.md | Basic CSP enable with algorithm |
| csp-advanced.md | Full config with directives + static headers |
'self' explicitly — not included by default in resourcesexperimentalStaticHeaders for Vercel/Netlifydev mode (doesn't work — always use build + preview)<ClientRouter /> with CSP enabled'self' when using resources arrayunsafe-inline (defeats purpose of CSP)