content-security-policy
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is purely instructional and provides best practices for configuring browser security headers.
- [INDIRECT_PROMPT_INJECTION]: The skill uses the
$ARGUMENTSplaceholder to ingest user-provided context. While this is an entry point for external data, the skill lacks executable capabilities (subprocess calls, file writes, or network operations), limiting the impact of any potential injection to the agent's textual response style or content accuracy. - [EXTERNAL_DOWNLOADS]: The skill references documentation and examples from trusted and well-known sources, including the W3C, OWASP, and MDN. These are documented for reference purposes and do not involve runtime code execution.
Audit Metadata