security-headers-configuration

Configures HTTP security headers to protect against XSS, clickjacking, and MIME sniffing attacks. Use when hardening web applications, passing security audits, or implementing Content Security Policy.

1.41x

Quality

93%

Does it follow best practices?

Impact

92%

1.41x

Average score across 3 eval scenarios

Securityby

Passed

No known issues

Evaluation results

96%

22%

Hardening an Express.js API Before Security Audit

Express.js helmet security headers

Criteria

Without context

With context

Helmet package used

100%

Helmet added as middleware

100%

helmet in package.json

100%

CSP default-src 'self'

100%

frameAncestors none

100%

X-Frame-Options DENY

50%

X-Content-Type-Options nosniff

100%

HSTS includeSubDomains

100%

CSP enforcement mode

100%

Non-permissive CSP policy

100%

img-src allows data and https

100%

82%

28%

Flask Application Security Compliance Review

Flask-Talisman nonce-based CSP

Criteria

Without context

With context

Flask-Talisman used

100%

flask-talisman in requirements

100%

No unsafe-inline in style-src

100%

Nonce-based style approach

100%

report_only disabled

100%

HSTS max-age 31536000

100%

HSTS includeSubDomains

100%

HSTS preload

100%

frame_options DENY

100%

frame-ancestors none in CSP

100%

base-uri self in CSP

form-action self in CSP

100%

32%

Nginx Security Header Hardening for Static Site

Nginx security header directives

Criteria

Without context

With context

HSTS header present

100%

HSTS max-age 31536000

100%

HSTS includeSubDomains

100%

HSTS preload

100%

X-Frame-Options DENY

100%

X-Content-Type-Options nosniff

100%

X-XSS-Protection 1 mode=block

100%

Referrer-Policy set

100%

Permissions-Policy present

100%

always keyword used

100%

CSP present

100%

No wildcard CSP

100%

Repository: secondsky/claude-skills
Commit: 90d6bd7

Evaluated: about 1 month ago
Agent: Claude Code
Model: Claude Sonnet 4.6

Table of Contents

Hardening an Express.js API Before Security Audit Flask Application Security Compliance Review Nginx Security Header Hardening for Static Site

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.