security-headers-configuration
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a legitimate technical resource for web application hardening. The configuration snippets provided for Nginx, Express, and Apache align with industry-standard security headers (HSTS, CSP, X-Frame-Options) and utilize recommended security libraries.
- [INDIRECT_PROMPT_INJECTION]: The Python header testing script in
references/python-apache.mdaccepts a user-provided URL as input. This represents a potential surface for processing untrusted data; however, the script performs a standard diagnostic HTTP GET request and reports header values back to the user without further execution, which is considered safe behavior for a development tool. - [EXTERNAL_DOWNLOADS]: The skill provides links to well-known and trusted external security auditing services, including the Mozilla Observatory and Google's CSP Evaluator. These references are clearly labeled and intended for legitimate security verification purposes.
Audit Metadata