security-headers

Headers are set by the deployment, not by the code alone: the platform, CDN, and reverse proxy all matter. So this skill starts by asking whether it is looking at production.

Activate when

• A deployed URL (production or a production-like preview) exists, or the owner is about to configure hosting.
• production-all routes here (check 39).
• Not on a local dev server as a verdict (it is UNKNOWN), and not as a replacement for a security review.

Inspect

1. Where are you looking? Local dev, preview, or production. Headers on localhost say almost nothing about a Vercel/Netlify/Cloudflare deployment.
2. Fetch headers: curl -sI -L https://<site>/ and a few key pages, an API route, and a static asset. Note the redirect chain (http:// → https://, apex ↔ www), status, and each hop's headers. TLS certificate validity and expiry (curl -vI output or openssl s_client), HTTP→HTTPS redirect, mixed content (observe-runtime reports MIXED_CONTENT).
3. Evaluate each header for this site: