What problem does it solve? Web applications often ship without critical HTTP security headers like HSTS, CSP, and X-Frame-Options, leaving users exposed to XSS, clickjacking, SSL stripping, and session hijacking. This Skill systematically audits response headers and cookie attributes to find missing or misconfigured browser-level protections. ## Core Features & Use Cases - Header Analysis: Checks HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy against recommended values, flagging dangerous directives like unsafe-inline and wildcards. - Cookie Security Audit: Verifies Secure, HttpOnly, and SameSite attributes on session cookies and detects information disclosure via Server and X-Powered-By headers. - Graded Reporting: Produces a letter-grade assessment with severity-ranked findings and prioritized remediation recommendations. - Use Case: During an authorized web application penetration test, run the audit against login and account pages to quickly identify that the session cookie lacks the Secure flag and the CSP allows unsafe-inline scripts, then deliver a prioritized hardening report. ## Quick Start Audit the security headers of https://target.example.com including the /login and /account pages and give me a graded report with remediation priorities.
