csp-skill

csp-skill is a public Codex skill repository for auditing and implementing Content Security Policy across web applications.

Overview

This repository packages a ready-to-use CSP skill together with reference material that explains the browser rules, implementation patterns, and security tradeoffs behind strong policies.

It is designed for:

• Codex agents that need to audit or implement CSP
• engineers who want a practical, teachable CSP reference
• projects that need a repeatable report-only to enforcement workflow

Repository layout

• csp/ - installable Codex skill
• csp/SKILL.md - agent-facing workflow and triggers
• csp/references/ - CSP theory, implementation guidance, and security patterns
• csp/assets/ - visual assets used by the skill

Getting started

1. Clone the repository.
2. Copy csp/ into your Codex skills directory, or point Codex at this repo if you keep skills versioned in place.
3. Invoke the skill with /csp audit or /csp implement.
4. Use the reference files when you need the reasoning behind a policy choice.

Core workflow

• detect the stack and rendering model
• audit inline code and external resources
• classify each finding as refactor, nonce, hash, allowlist, or remove
• draft the smallest policy that fits the app
• roll out in Content-Security-Policy-Report-Only first when risk is unclear
• verify browser behavior and tighten the policy over time

Notes

• The skill is intentionally written in a didactic style so it can serve as both an agent tool and a learning resource.
• The reference material is paraphrased knowledge, not copied prose.

License

MIT. See LICENSE.