What problem does it solve? Public web sites often ship with missing or weak HTTP security headers, insecure cookies, mixed content, or leaked server versions, and hand-checking with curl misses findings. This Skill measures every dimension with a bundled scanner, grades each finding SEVERE/MEDIUM/MINOR/OK, and gates fixes on a clean re-scan. ## Core Features & Use Cases - Automated header auditing: Run audit_headers.py against a URL to grade CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, and X-XSS-Protection in one pass. - Cookie, redirect, and mixed-content checks: Detect Set-Cookie flags missing Secure/HttpOnly/SameSite, verify the HTTP-to-HTTPS 301/308 redirect, and find http:// subresources in returned HTML. - Guided safe rollout: Follow a staged order (TLS, safe headers, CSP report-only, CSP enforced, short then long HSTS) with nginx snippets and per-header recommended values from the reference file. - Use Case: Before launching a site, scan it, apply the proposed nginx config diffs for the SEVERE findings, then re-scan until the report shows 0 SEVERE and 0 MEDIUM on every representative page. ## Quick Start Ask the AI to audit https://your-site.com with the web security baseline skill and propose fixes for any SEVERE or MEDIUM findings.
