{"uid":"cap_EBBR4kRmpW5pY1zBp-BTf","slug":"aiskills402-csp-header-review-5faac5ef","name":"AISkills402: CSP Header Review","description":"CSP Header Review — Reviews ONE Content-Security-Policy header, with any note pasted beside it, and lists only the gaps that let injected script run or let the page be framed, one line each with a fixed code, the directive, why it hurts and the fix - or exactly No findings. It catches unsafe-eval or unsafe-inline in the script directive, a star, a data source or a bare scheme as a script source, a policy with neither object-src nor a default-src, a missing base-uri, a missing frame-ancestors, a…","url":"https://api.aiskills402.com/v1/skills/csp-header-review/file?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD"],"type":"string"},"headers":{"type":"object","additionalProperties":{"type":"string"}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_QwtV0N5D-kp3FR6X_xVQd","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Reviews a Content-Security-Policy header and lists only the security gaps that allow injected script execution or page framing, one finding per line with a code, directive, explanation, and fix.","exampleAgentPrompt":"Review this Content-Security-Policy header for security gaps that could let injected scripts run or allow the page to be framed: \"default-src 'self'; script-src 'self' 'unsafe-inline'; object-src 'none'\"","exampleUseCases":[{"title":"Pre-deployment CSP audit","prompt":"I'm about to deploy my site — can you review this CSP header and tell me if anything would let an attacker inject and run scripts? Here it is: \"default-src 'self'; script-src * 'unsafe-eval'; frame-ancestors 'self'\""},{"title":"Clickjacking vulnerability check","prompt":"My security team flagged that our page might be frameable by attackers. Can you check this Content-Security-Policy header and tell me specifically if frame-ancestors is missing or misconfigured? Header: \"default-src 'self' https:; script-src 'self'\""},{"title":"Post-incident CSP hardening review","prompt":"We just had an XSS incident and I want to lock down our CSP. Please audit this header and list every directive gap that could allow script injection, with a fix for each: \"script-src 'self' data: 'unsafe-inline'; style-src 'self'\""}],"resultDescription":"A list of security findings, one per line, each containing a fixed finding code, the affected CSP directive, an explanation of why the configuration is dangerous, and a concrete fix. If no exploitable gaps are detected, the endpoint returns exactly 'No findings'.","failureModes":["Malformed or missing CSP header value returns an error or empty analysis","Extremely long or complex policies with many directives may produce truncated output","Policies using nonce-based or hash-based allowlists may be misclassified if context is incomplete","Non-CSP header strings passed as input may yield unexpected or meaningless findings"],"whenToPreferThis":"Choose this endpoint when you need a focused, line-by-line audit of a single Content-Security-Policy header specifically for script injection and framing vulnerabilities, rather than a general web security scanner or full HTTP response header analysis. It is ideal for CI/CD pipelines, pre-deployment checks, or rapid triage after a security incident where you already have the CSP string and need actionable, coded findings fast.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-31T18:40:17.149Z","isFirstParty":false,"canonicalSlug":"aiskills402-csp-header-review-5faac5ef"}