The Agent Skills Directory

[SAFE]: The skill provides standard security best practices for web application development, specifically focusing on HTTP response headers.
[EXTERNAL_DOWNLOADS]: The Content Security Policy (CSP) examples include references to well-known and trusted services such as Stripe (js.stripe.com), Clerk, and Google Analytics. These are documented neutrally as required integrations for the described architecture.
[COMMAND_EXECUTION]: The documentation includes curl commands intended for manual verification of security headers by the user on their own local or production environment. These are benign educational examples.
[DYNAMIC_EXECUTION]: The skill notes the use of 'unsafe-inline' and 'unsafe-eval' within the CSP configuration. While these directives reduce the effectiveness of CSP against XSS, the skill explicitly describes this as a necessary trade-off for the specific framework (Next.js/Clerk) and recommends input sanitization as a mitigating control.

security-headers