security-headers

仓库创建 2026年7月26日最近提交 1 天前SkillHot 收录 10 小时前

▸ 精选理由

提出可落地的头部配置与兼容性注意点，易于实施。

这个 Skill 做什么

检查并加固 HTTP 响应安全头（如 CSP、HSTS）以减小攻击面。

检查并加固网站的 HTTP 安全响应头（比如 CSP、HSTS 等），把真正能降低风险的配置落地，而不是做形式化设置。说明每个 header 的实际防护价值、常见误配和如何在不影响功能下部署。适合快速评估或上线前的安全加固。

▸ 展开 SKILL.md 英文原文

Use when reviewing or hardening a web app's HTTP response headers — CSP, HSTS, and the rest — knowing which actually reduce risk and which are theatre.

开发编程安全头CSPHSTS通用

Stars

Forks

仓库内 Skill

积累中

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/03-web-application-security/10-security-headers/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/03-web-application-security/10-security-headers/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

## Purpose

Security headers are defence-in-depth: they don't fix vulnerabilities, they shrink the blast radius when one exists. A good CSP turns many XSS bugs into non-events; HSTS closes the downgrade window. This skill covers which headers earn their place, how to check them, and how to set them without breaking the app.

## When to use it

During a web assessment (quick win to check) and during hardening. Fair warning: header scanners hand out low-severity findings generously — this skill is about knowing which matter so you don't drown a report in noise.

## Procedure

1. Pull the response headers and read what's there — and what's missing:
   ```
   curl -sI https://app.tld | grep -iE

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有