http-sec-auditlisted

# HTTP Security Header Audit Checks a site's response headers against modern web-security best practices and returns prioritized findings with concrete fixes. The analysis core is pure and offline-testable; live scanning uses only Python's stdlib `urllib`. ## When to use this skill - "Audit the security headers on https://example.com." - "Is my CSP / HSTS / cookie config correct?" - "Why is this site flagged for missing headers?" ## What it checks - **Content-Security-Policy** — presence, `unsafe-inline`, wildcards. - **Strict-Transport-Security** — presence and `max-age` length. - **X-Content-Type-Options: nosniff**, **X-Frame-Options** / `frame-ancestors`. - **Referrer-Policy**, **Permissions-Policy**. - **Information disclosure** — `Server` / `X-Powered-By` version banners. - **Cookies** — `Secure`, `HttpOnly`, `SameSite` (incl. `SameSite=None` without `Secure`). ## How to run it ```bash # Live scan python skills/http-sec-audit/audit.py https://example.com # JSON output python skills/http-sec-audit/audit.py https://example.com --json # Offline: audit a saved raw header block (no network) python skills/http-sec-audit/audit.py --headers-file response_headers.txt # Only fail CI on high/critical (a missing Permissions-Policy is LOW and # shows up on almost every site) python skills/http-sec-audit/audit.py https://example.com --min-severity high ``` **Exit codes:** `0` clean · `1` findings reported · `2` fetch/usage error. Every reported finding fails the build; ra