{
  "instruction": "Use Helmet middleware for security headers",
  "relevant_when": "Agent creates or modifies an Express application, adds routes to an Express app, or sets up an Express project",
  "context": "Every Express app must have Helmet registered before all route handlers. Helmet sets secure HTTP headers by default: CSP, X-Content-Type-Options, X-Frame-Options, HSTS, and more. This is a baseline requirement, not an optional enhancement.",
  "sources": [
    {
      "type": "file",
      "filename": "skills/express-security-basics/SKILL.md",
      "tile": "tessl-labs/express-security-basics@0.2.0"
    }
  ],
  "checklist": [
    {
      "name": "helmet-installed",
      "rule": "Agent includes the helmet package in dependencies",
      "relevant_when": "Agent creates or modifies an Express application"
    },
    {
      "name": "helmet-middleware-added",
      "rule": "Agent registers app.use(helmet()) before route handlers, not after",
      "relevant_when": "Agent creates or modifies an Express application"
    },
    {
      "name": "csp-not-entirely-disabled",
      "rule": "Agent does not set contentSecurityPolicy: false for apps that serve HTML. Disabling CSP is only acceptable for pure JSON API servers.",
      "relevant_when": "Agent customizes Helmet configuration"
    }
  ]
}