菜单
Use when configuring Content Security Policy (CSP) in Astro 7, setting security headers, managing script/style hashes, using nonces, or implementing experimentalStaticHeaders for adapter deployments.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Systematic development workflow: Analyze → Plan → Execute → eLicit → eXamine. Use for ANY development task: features, bug fixes, refactoring, hotfixes. Triggers: "implement", "create", "build", "fix", "add feature", "refactor", "develop". Auto-detects project type (Laravel, Next.js, React, Swift) and loads framework-specific references. Enforces: files <100 lines, interfaces separated, SOLID principles, expert self-review, sniper validation. Modes: --auto (default), --manual, --skip-elicit
Auto-review skill for expert agents. After coding, expert applies elicitation techniques to self-correct before sniper validation. Inspired by BMAD-METHOD. Use when: an expert agent needs to self-review and self-correct code after the Execute phase, before sniper validation.
Use when marking a task as complete, finishing a feature, or claiming a bug is fixed. Ensures functional resolution is verified with evidence before closing. Do NOT use for: lint/type/code-quality validation (use code-quality / sniper AFTER functional verification passes).
Smart conventional commit with security validation, branch flow enforcement, and auto-detection. Use when committing changes, saving work, staging and committing, or choosing a conventional commit message.
Use when committing, branching, opening PRs, or deciding merge strategy. Covers GitHub Flow (default), trunk-based, branch naming conventions, squash vs rebase, branch lifecycle, and protected branch enforcement.
Universal post-commit actions. CHANGELOG update for all repos (git tag is created POST-MERGE, not here — see `commit` command Step 8). Plugin version bumping for marketplace repos. Triggered after any code commit (except wip/amend/undo).
| name | astro-security |
| description | Use when configuring Content Security Policy (CSP) in Astro 7, setting security headers, managing script/style hashes, using nonces, or implementing experimentalStaticHeaders for adapter deployments. |
Targets: Astro 7.
Before ANY implementation, spawn 3 parallel agents (Codex spawn_agent):
After implementation, run sniper for validation.
security.csp in astro.config.mjsexperimentalStaticHeaders for adapter-based CSP headersAstro 6 ships Content Security Policy as a stable feature (previously experimental). When enabled:
<meta http-equiv="content-security-policy"> in each page's <head>script-src and style-src directives by defaultLimitations:
dev mode — test with build + preview<ClientRouter /> view transitions (use native View Transition API)| Topic | Reference | When to Consult |
|---|---|---|
| CSP overview | csp-overview.md | Understanding CSP in Astro |
| Configuration | csp-config.md | All config options |
| Script directive | script-directive.md | script-src configuration |
| Style directive | style-directive.md | style-src configuration |
| Nonces | nonces.md | Dynamic script injection |
| Static headers | static-headers.md | Adapter-based CSP headers |
| Template | When to Use |
|---|---|
| csp-basic.md | Basic CSP enable with algorithm |
| csp-advanced.md | Full config with directives + static headers |
'self' explicitly — not included by default in resourcesexperimentalStaticHeaders for Vercel/Netlifydev mode (doesn't work — always use build + preview)<ClientRouter /> with CSP enabled'self' when using resources arrayunsafe-inline (defeats purpose of CSP)