Security Auditor
eigent-ai/eigent
Audits source code, dependencies and config files for vulnerabilities and hardcoded secrets, using two bundled Python scanners and an OWASP Top 10 checklist.
Configures HTTP security headers to protect against XSS, clickjacking, and MIME sniffing attacks.
Install Security Headers Configuration
$ npx skills add secondsky/claude-skills --skill security-headers-configuration -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install secondsky/claude-skills security-headers-configuration --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/secondsky/claude-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/security-headers-configuration/skills/security-headers-configuration .claude/skills/security-headers-configuration && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "security-headers-configuration" agent skill from https://github.com/secondsky/claude-skills/tree/main/plugins/security-headers-configuration/skills/security-headers-configuration into .claude/skills/security-headers-configuration/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-headers-configuration", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/secondsky/claude-skills/tree/main/plugins/security-headers-configuration/skills/security-headers-configurationType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add secondsky/claude-skills --skill security-headers-configuration -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install secondsky/claude-skills security-headers-configuration --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/secondsky/claude-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/security-headers-configuration/skills/security-headers-configuration .agents/skills/security-headers-configuration && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "security-headers-configuration" agent skill from https://github.com/secondsky/claude-skills/tree/main/plugins/security-headers-configuration/skills/security-headers-configuration into .agents/skills/security-headers-configuration/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-headers-configuration", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add secondsky/claude-skills --skill security-headers-configuration -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install secondsky/claude-skills security-headers-configuration --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/secondsky/claude-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/security-headers-configuration/skills/security-headers-configuration .cursor/skills/security-headers-configuration && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "security-headers-configuration" agent skill from https://github.com/secondsky/claude-skills/tree/main/plugins/security-headers-configuration/skills/security-headers-configuration into .cursor/skills/security-headers-configuration/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-headers-configuration", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/secondsky/claude-skills.git --path plugins/security-headers-configuration/skills/security-headers-configuration--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add secondsky/claude-skills --skill security-headers-configuration -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install secondsky/claude-skills security-headers-configuration --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/secondsky/claude-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/security-headers-configuration/skills/security-headers-configuration .gemini/skills/security-headers-configuration && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "security-headers-configuration" agent skill from https://github.com/secondsky/claude-skills/tree/main/plugins/security-headers-configuration/skills/security-headers-configuration into .gemini/skills/security-headers-configuration/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-headers-configuration", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install secondsky/claude-skills security-headers-configurationInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add secondsky/claude-skills --skill security-headers-configuration -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/secondsky/claude-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/security-headers-configuration/skills/security-headers-configuration .github/skills/security-headers-configuration && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "security-headers-configuration" agent skill from https://github.com/secondsky/claude-skills/tree/main/plugins/security-headers-configuration/skills/security-headers-configuration into .github/skills/security-headers-configuration/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-headers-configuration", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add secondsky/claude-skills --skill security-headers-configuration -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install secondsky/claude-skills security-headers-configuration --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/secondsky/claude-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/security-headers-configuration/skills/security-headers-configuration .opencode/skills/security-headers-configuration && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "security-headers-configuration" agent skill from https://github.com/secondsky/claude-skills/tree/main/plugins/security-headers-configuration/skills/security-headers-configuration into .opencode/skills/security-headers-configuration/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-headers-configuration", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
security-headers-configuration- GitHub stars
- 227
- Token cost
- ~638 tokens
- SKILL.md length
- 116 words
- Files
- 2 (incl. references)
- Skills in repo
- 169
- Repo updated
- First seen
- Licence
- MIT
At a glance
Configures HTTP security headers to protect against XSS, clickjacking, and MIME sniffing attacks.
- Hardening web applications
- SKILL.md covers Essential Headers, Express Implementation, Nginx Configuration and Verification Tools, plus 3 more sections
- Reaches fonts.gstatic.com
- Passing security audits
What it does
Security Headers Configuration is an agent skill from secondsky/claude-skills. Configures HTTP security headers to protect against XSS, clickjacking, and MIME sniffing attacks. Use when hardening web applications, passing security audits, or implementing Content Security Policy.
Its SKILL.md is about 640 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/python-apache.md`).
It sits in Security, covering Secure coding, Security review and Web application vulnerabilities. It works with Python. The repository describes itself as: Production-ready skills for Claude Code CLI - Cloudflare, React, Tailwind v4, and AI integrations. The licence is MIT.
When your agent uses it
- Hardening web applications
- Passing security audits
- Implementing Content Security Policy
Example prompts
- “Use the security-headers-configuration skill to configure HTTP security headers to protect against XSS, clickjacking, and MIME sniffing attacks”
- “/security-headers-configuration”
Requirements
- Python 3
What it can do on your machine
Read from SKILL.md and the folder at commit 8837836. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are javascript and nginx).
From the folder's file list and the shell code blocks in SKILL.md.
Network
Hosts in commands or code, which the agent is likely to contact:
fonts.gstatic.com
Also links to:
securityheaders.comobservatory.mozilla.orgcsp-evaluator.withgoogle.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Security Headers Configuration loads about 638 tokens when it runs, and up to ~2.1k if it reads all its reference files. Until then it costs about 58 tokens; SKILL.md has 116 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from secondsky/claude-skills at commit 8837836, republished under its MIT licence (© secondsky). 116 words, ~638 tokens.
Download SKILL.mdSave it as
.claude/skills/security-headers-configuration/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.- name
- security-headers-configuration
- description
- Configures HTTP security headers to protect against XSS, clickjacking, and MIME sniffing attacks. Use when hardening web applications, passing security audits, or implementing Content Security Policy.
- license
- MIT
Security Headers Configuration
Implement HTTP security headers to defend against common browser-based attacks.
Essential Headers
| Header | Purpose | Value |
|---|---|---|
| HSTS | Force HTTPS | max-age=31536000; includeSubDomains |
| CSP | Restrict resources | default-src 'self' |
| X-Frame-Options | Prevent clickjacking | DENY |
| X-Content-Type-Options | Prevent MIME sniffing | nosniff |
Express Implementation
const helmet = require('helmet');
app.use(helmet());
// Custom CSP
app.use(helmet.contentSecurityPolicy({
directives: {
defaultSrc: ["'self'"],
scriptSrc: ["'self'", "'unsafe-inline'"],
styleSrc: ["'self'", "'unsafe-inline'"],
imgSrc: ["'self'", "data:", "https:"],
connectSrc: ["'self'", "https://api.example.com"],
fontSrc: ["'self'", "https://fonts.gstatic.com"],
frameAncestors: ["'none'"]
}
}));Nginx Configuration
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;Verification Tools
Security Headers Checklist
- HSTS enabled with long max-age
- CSP configured and tested
- X-Frame-Options set to DENY
- X-Content-Type-Options set to nosniff
- Referrer-Policy configured
- Permissions-Policy disables unused features
Additional Implementations
See references/python-apache.md for:
- Python Flask security headers middleware
- Flask-Talisman library configuration
- Apache .htaccess configuration
- Header testing script
Common Mistakes
- Setting CSP to report-only permanently
- Using overly permissive policies
- Forgetting to test after changes
- Not including all subdomains in HSTS
© secondsky, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 1 other file (references) in plugins/security-headers-configuration/skills/security-headers-configuration of secondsky/claude-skills.
- SKILL.md
- references/python-apache.md
Open the folder on GitHubat commit 8837836
Compare with similar skills
Security Headers Configuration next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Security Headers Configuration this skillsecondsky/claude-skills | 227 | — | ~638 | Automated safety check: Pass | MIT | |
| Security Auditoreigent-ai/eigent | 15k | — | ~1.8k | Automated safety check: Notes | Apache-2.0 | |
| CodeQL Security Scantrailofbits/skills | 7.4k | — | ~4.6k | Automated safety check: Notes | CC-BY-SA-4.0 | |
| Security Audit Scannerruvnet/ruflo | 74k | 2 repos | ~823 | Automated safety check: Pass | MIT | |
| Security Verification Gatefengshao1227/ccg-workflow | 5.9k | — | ~621 | Automated safety check: Notes | MIT | |
| Security AuditTheDecipherist/claude-code-mastery | 550 | — | ~1.3k | Automated safety check: Notes | MIT |
Similar skills
- Official
CodeQL Security Scan
trailofbits/skills
Scans a codebase for vulnerabilities with CodeQL's data flow and taint tracking in run-all or important-only modes, including data extensions for project-specific sources and sinks.
Security Audit Scanner
ruvnet/ruflo
Runs claude-flow CLI security scans for input validation, path traversal, SQL injection, XSS, hardcoded secrets and known CVEs, and writes an audit report.
Security Verification Gate
fengshao1227/ccg-workflow
Scans code with a bundled Node script for injection, secrets, XSS and other risky patterns, ranks findings by severity and checks that security decisions are documented.
Security Audit
TheDecipherist/claude-code-mastery
Checks a codebase for hardcoded secrets, vulnerable dependencies, weak input handling, weak authentication and unsafe transport settings before deployment or merge.
- Official
Python kwargs setattr Allowlist
microsoft/onnxruntime
Shows how to replace unsafe hasattr and setattr loops over user-controlled kwargs with an explicit allowlist when configuring ONNX Runtime option objects.
More from secondsky/claude-skills
All 169 skills in this repoTanstack AI
secondsky/claude-skills
TanStack AI (alpha) provider-agnostic type-safe chat with streaming for OpenAI, Anthropic, Gemini, Ollama.
Auto Animate
secondsky/claude-skills
AutoAnimate (@formkit/auto-animate) zero-config animations for React.
Base UI React
secondsky/claude-skills
MUI Base UI unstyled React components with Floating UI. An agent skill from secondsky/claude-skills.
Cloudflare Images
secondsky/claude-skills
This skill should be used when the user asks to "upload images to Cloudflare", "implement direct creator upload", "configure image transformations", "optimize WebP/AVIF", "create image variants"…
Cloudflare Nextjs
secondsky/claude-skills
Deploy Next.js to Cloudflare Workers via the OpenNext adapter (@opennextjs/cloudflare).
Cloudflare Sandbox
secondsky/claude-skills
Cloudflare Sandboxes SDK for secure code execution in Linux containers at edge.
Related
Works with
Categories
Questions about Security Headers Configuration
What does Security Headers Configuration do?
Configures HTTP security headers to protect against XSS, clickjacking, and MIME sniffing attacks. Security Headers Configuration is an agent skill from secondsky/claude-skills. Configures HTTP security headers to protect against XSS, clickjacking, and MIME sniffing attacks.
When should I use Security Headers Configuration?
Security Headers Configuration fits situations like: hardening web applications; passing security audits; implementing Content Security Policy.
How do I install Security Headers Configuration in Claude Code?
Run `npx skills add secondsky/claude-skills --skill security-headers-configuration -a claude-code`. Or copy the skill folder (plugins/security-headers-configuration/skills/security-headers-configuration in secondsky/claude-skills) into .claude/skills/security-headers-configuration in your project. Claude Code loads it when a task matches its description.
How do I install Security Headers Configuration in Codex?
Run `npx skills add secondsky/claude-skills --skill security-headers-configuration -a codex`. Or copy the skill folder (plugins/security-headers-configuration/skills/security-headers-configuration in secondsky/claude-skills) into .agents/skills/security-headers-configuration in your project. Codex loads it when a task matches its description.
Can I use Security Headers Configuration in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add secondsky/claude-skills --skill security-headers-configuration -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-headers-configuration, .gemini/skills/security-headers-configuration, .github/skills/security-headers-configuration and .opencode/skills/security-headers-configuration in your project.
What does Security Headers Configuration need to run?
SKILL.md names no scripts, command-line tools or credentials: Security Headers Configuration is instructions for the agent only. Our summary lists: Python 3.
Does Security Headers Configuration access the network?
SKILL.md names 4 domains. In commands or code: fonts.gstatic.com; the agent is likely to contact it when it follows the instructions. As links in the text: securityheaders.com, observatory.mozilla.org and csp-evaluator.withgoogle.com. This is read from the text; nothing was executed.
Is Security Headers Configuration safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Security Headers Configuration use?
Security Headers Configuration is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Security Headers Configuration use?
About 638 tokens (SKILL.md is roughly 2.6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1.5k tokens, read only when the agent opens those files.
What are the alternatives to Security Headers Configuration?
Skills that share tags, products or a category with Security Headers Configuration: Security Auditor (eigent-ai/eigent, 15k stars), CodeQL Security Scan (trailofbits/skills, 7.4k stars), Security Audit Scanner (ruvnet/ruflo, 74k stars) and Security Verification Gate (fengshao1227/ccg-workflow, 5.9k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Security Headers Configuration?
secondsky (a GitHub user) maintains it in secondsky/claude-skills, which has 227 GitHub stars. The repository holds 169 skills in this directory. The repository was last updated on September 28, 2026.
Source: secondsky/claude-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.