Content Security Policy Generator
Generates secure Content Security Policies to mitigate XSS attacks based on website structure and desired content sources.
Install on your platform
We auto-selected Claude Code based on this skill’s supported platforms.
Run in terminal (recommended)
claude mcp add content-security-policy-generator npx -- -y @trustedskills/content-security-policy-generator
Or manually add to ~/.claude/settings.json
{
"mcpServers": {
"content-security-policy-generator": {
"command": "npx",
"args": [
"-y",
"@trustedskills/content-security-policy-generator"
]
}
}
}Requires Claude Code (claude CLI). Run claude --version to verify your install.
About This Skill
What it does
This skill generates Content Security Policy (CSP) headers. CSPs are a crucial security mechanism that helps protect web applications from cross-site scripting (XSS) and other code injection attacks by defining allowed sources for various resources like scripts, stylesheets, and images. The generator simplifies the process of creating these policies based on your application's needs.
When to use it
- Securing a new website: Generate a baseline CSP when launching a new web project.
- Hardening an existing site: Improve the security posture of an older website by implementing or refining its CSP.
- Responding to security audits: Quickly create CSPs as part of addressing recommendations from security assessments.
- Enforcing stricter resource loading: Control exactly where your application can load resources from, mitigating potential vulnerabilities.
Key capabilities
- Generates CSP headers based on provided directives.
- Simplifies the creation of complex CSP rules.
- Helps mitigate XSS and other code injection attacks.
Example prompts
- "Generate a Content Security Policy that allows scripts only from example.com."
- "Create a CSP allowing images from data: URLs and example.net."
- "I need a CSP for a site using inline styles and fonts from Google Fonts, please generate one."
Tips & gotchas
The generated CSP may require adjustments based on your specific application's needs and dependencies. Thoroughly test any changes to your CSP in a staging environment before deploying them to production.
Tags
TrustedSkills Verification
Unlike other registries that point to live repositories, TrustedSkills pins every skill to a verified commit hash. This protects you from malicious updates — what you install today is exactly what was reviewed and verified.
Security Audits
| Gen Agent Trust Hub | Pass |
| Socket | Pass |
| Snyk | Pass |
🌐 Community
Passed automated security scans.