What problem does it solve? When XSS or data exfiltration attempts are blocked by a Content Security Policy, testers often stall because base models suggest generic fixes like unsafe-inline without checking the actual policy. This Skill provides a systematic methodology for finding real weaknesses in CSP configurations during authorized web security assessments. ## Core Features & Use Cases - Directive-by-Directive Analysis: Covers bypass techniques for script-src variants ('self', CDN whitelists, nonces, strict-dynamic, unsafe-eval) plus the commonly missed base-uri, form-action, and frame-ancestors gaps that have no default-src fallback. - Exfiltration Channel Catalog: Documents data exfiltration paths CSP cannot block, including DNS prefetch, WebRTC, CSS injection, and form submission, for scenarios where script execution is fully prevented. - Decision Tree Workflow: A structured decision tree walks from reading the raw policy through weakness identification to selecting the appropriate bypass or fallback technique. - Use Case: During a CTF or authorized pentest, you find a reflected XSS but the response sets script-src 'self'. Use this Skill to identify a JSONP endpoint on the same origin or an uploadable .js path to execute the payload. ## Quick Start Analyze the target's Content-Security-Policy header and identify which directives are missing or bypassable, then recommend a concrete exploitation path.
