# Implement a Content Security Policy (content-security-policy)

> Checks for and implements a strict Content Security Policy, combined with HTML sanitization and Trusted Types against XSS and injection.

- Category: [Hardening](https://www.myskills.tools/en/categories/hardening/)
- Source: Community · David Dias
- Repository: https://github.com/thedaviddias/Front-End-Checklist/tree/main/skills/content-security-policy (commit 4b0ddb9)
- SKILL.md: https://github.com/thedaviddias/Front-End-Checklist/blob/main/skills/content-security-policy/SKILL.md
- Install command: `npx skills add thedaviddias/Front-End-Checklist --skill content-security-policy`
- License: MIT
- Compatible with: Any SKILL.md agent
- Permissions: read-repo ✓, write-files ✓, shell ✗, network ✓
- Status: Scan passed
- A rule scan cannot catch every risk. Read this skill's SKILL.md and check its permissions before installing.

## Core rule

CSP reduces blast radius; it does not replace output encoding and sanitization.

## Execution Phases

1. **Check** — Check for a CSP header and its directives, and review sinks such as innerHTML and dangerouslySetInnerHTML.
2. **Start report-only** — Test with Content-Security-Policy-Report-Only first and collect violation reports so nothing breaks.
3. **Tighten** — Set a strict default-src and allow specific sources; use nonces or hashes for inline scripts and avoid unsafe-inline and unsafe-eval.
4. **Verify in production-like env** — Verify the effective response in a production-like environment; larger apps can add Trusted Types as defense in depth.

## Permissions (summarised from SKILL.md)

| Capability | Needed | Details |
|---|---|---|
| File writes | Required | Edits server or framework config to set CSP headers and adds sanitization at injection sinks. |
| Command execution | Not required | The skill does not call for specific commands. |
| Network outbound | Limited | Accesses the target site only to verify its effective response headers. |

## SKILL.md frontmatter (YAML)

```yaml
---
name: content-security-policy
description: "Use when reviewing headers, forms, cookies, or third-party integrations related to Implement a content security policy. Validate the effective browser and HTTP behavior in a production-like environment."
metadata:
  category: security
  priority: high
  difficulty: advanced
  estimatedTime: "45"
  source: frontendchecklist.io
  url: https://frontendchecklist.io/rules/security/content-security-policy
---
```

Home: https://www.myskills.tools/en/ · URL: https://www.myskills.tools/en/skills/content-security-policy/