astro-security
starsforks
How to install astro-security?
fusengine/agents/astro-security
$npx -y skills add fusengine/agents --skill astro-securityUse when configuring Content Security Policy (CSP) in Astro 7, setting security headers, managing script/style hashes, using nonces, or implementing experimentalStaticHeaders for adapter deployments.
SKILL.md
| 1 | # Astro Security |
| 2 | |
| 3 | ## Agent Workflow (MANDATORY) |
| 4 | |
| 5 | Before ANY implementation, use `TeamCreate` to spawn 3 agents: |
| 6 | |
| 7 | 1. **fuse-ai-pilot:explore-codebase** - Analyze existing security config, adapters, headers |
| 8 | 2. **fuse-ai-pilot:research-expert** - Verify latest Astro 7 CSP docs via Context7/Exa |
| 9 | 3. **mcp__context7__query-docs** - Check CSP compatibility with deployment adapter |
| 10 | |
| 11 | After implementation, run **fuse-ai-pilot:sniper** for validation. |
| 12 | |
| 13 | --- |
| 14 | |
| 15 | ## Overview |
| 16 | |
| 17 | ### When to Use |
| 18 | |
| 19 | - Enabling CSP in an Astro project (stable in v6.0.0) |
| 20 | - Configuring `security.csp` in `astro.config.mjs` |
| 21 | - Adding SHA-256/384/512 hashes for external scripts or styles |
| 22 | - Using nonces for dynamic script injection |
| 23 | - Setting up `experimentalStaticHeaders` for adapter-based CSP headers |
| 24 | |
| 25 | ### CSP in Astro |
| 26 | |
| 27 | Astro 6 ships Content Security Policy as a **stable** feature (previously experimental). When enabled: |
| 28 | - Astro automatically generates SHA hashes for all bundled scripts and styles |
| 29 | - Injects a `<meta http-equiv="content-security-policy">` in each page's `<head>` |
| 30 | - Supports `script-src` and `style-src` directives by default |
| 31 | |
| 32 | **Limitations:** |
| 33 | - Not supported in `dev` mode — test with `build` + `preview` |
| 34 | - External scripts and styles require manual hash configuration |
| 35 | - Incompatible with `<ClientRouter />` view transitions (use native View Transition API) |
| 36 | - Shiki syntax highlighter (inline styles) not currently supported |
| 37 | |
| 38 | --- |
| 39 | |
| 40 | ## Reference Guide |
| 41 | |
| 42 | ### Concepts |
| 43 | |
| 44 | | Topic | Reference | When to Consult | |
| 45 | |-------|-----------|-----------------| |
| 46 | | CSP overview | [csp-overview.md](references/csp-overview.md) | Understanding CSP in Astro | |
| 47 | | Configuration | [csp-config.md](references/csp-config.md) | All config options | |
| 48 | | Script directive | [script-directive.md](references/script-directive.md) | script-src configuration | |
| 49 | | Style directive | [style-directive.md](references/style-directive.md) | style-src configuration | |
| 50 | | Nonces | [nonces.md](references/nonces.md) | Dynamic script injection | |
| 51 | | Static headers | [static-headers.md](references/static-headers.md) | Adapter-based CSP headers | |
| 52 | |
| 53 | ### Templates |
| 54 | |
| 55 | | Template | When to Use | |
| 56 | |----------|-------------| |
| 57 | | [csp-basic.md](references/templates/csp-basic.md) | Basic CSP enable with algorithm | |
| 58 | | [csp-advanced.md](references/templates/csp-advanced.md) | Full config with directives + static headers | |
| 59 | |
| 60 | --- |
| 61 | |
| 62 | ## Best Practices |
| 63 | |
| 64 | 1. **Always test with build + preview** — CSP is inactive in dev mode |
| 65 | 2. **Start with SHA-512** — strongest hash algorithm |
| 66 | 3. **Use `'self'` explicitly** — not included by default in resources |
| 67 | 4. **Hash external scripts manually** — compute SHA hashes for CDN resources |
| 68 | 5. **Combine with adapter headers** — use `experimentalStaticHeaders` for Vercel/Netlify |
| 69 | |
| 70 | --- |
| 71 | |
| 72 | ## Forbidden |
| 73 | |
| 74 | - Testing CSP in `dev` mode (doesn't work — always use `build + preview`) |
| 75 | - Using `<ClientRouter />` with CSP enabled |
| 76 | - Forgetting to add `'self'` when using `resources` array |
| 77 | - Adding `unsafe-inline` (defeats purpose of CSP) |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
