The Agent Skills Directory

[SAFE]: The skill provides C# templates and instructions for implementing Content Security Policy (CSP), X-Frame-Options, and other security headers using custom middleware or the NWebsec library. The implementation follows security best practices for Umbraco 17.3+, specifically utilizing the platform's native ICspNonceService to manage nonces securely.
[SAFE]: The skill includes clear guidance on avoiding common pitfalls, such as the use of 'unsafe-inline' for scripts and the inappropriate application of 'strict-dynamic' in the backoffice context, which could break core functionality or weaken security.
[SAFE]: External references and dependencies, such as NWebsec and Google Tag Manager, are well-known, industry-standard services and libraries appropriate for the skill's stated purpose. All URLs provided for CSP policies are legitimate and target official vendor domains.
[SAFE]: The evaluation suite (evals/) contains deliberately flawed project configurations for testing purposes. These 'planted defects' (e.g., incorrect assembly names for tag helpers, manual nonce generation, or overly restrictive framing options) are clearly labeled as test data and are used to ensure the agent can correctly identify and remediate security issues in real-world scenarios.

umbraco-security-headers