fusengine/astro-security
plugins/astro-expert/skills/astro-security/SKILL.md
Use when configuring Content Security Policy (CSP) in Astro 7, setting security headers, managing script/style hashes, using nonces, or implementing experimentalStaticHeaders for adapter deployments.
$ install --global
skillsauthnpx skillsauth add fusengine/agents astro-securityInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 16, 2026, 2:43 AM77.5s9 files scanned
SKILL.md
- name:
- astro-security
- description:
- Use when configuring Content Security Policy (CSP) in Astro 7, setting security headers, managing script/style hashes, using nonces, or implementing experimentalStaticHeaders for adapter deployments.
- astro:
- 7
- user-invocable:
- true
- references:
- references/csp-overview.md, references/csp-config.md, references/script-directive.md, references/style-directive.md, references/nonces.md, references/static-headers.md, references/templates/csp-basic.md, references/templates/csp-advanced.md
- related-skills:
- astro-7, astro-deployment, solid-astro
Astro Security
Agent Workflow (MANDATORY)
Before ANY implementation, use TeamCreate to spawn 3 agents:
- fuse-ai-pilot:explore-codebase - Analyze existing security config, adapters, headers
- fuse-ai-pilot:research-expert - Verify latest Astro 7 CSP docs via Context7/Exa
- mcp__context7__query-docs - Check CSP compatibility with deployment adapter
After implementation, run fuse-ai-pilot:sniper for validation.
Overview
When to Use
- Enabling CSP in an Astro project (stable in v6.0.0)
- Configuring
security.cspinastro.config.mjs - Adding SHA-256/384/512 hashes for external scripts or styles
- Using nonces for dynamic script injection
- Setting up
experimentalStaticHeadersfor adapter-based CSP headers
CSP in Astro
Astro 6 ships Content Security Policy as a stable feature (previously experimental). When enabled:
- Astro automatically generates SHA hashes for all bundled scripts and styles
- Injects a
<meta http-equiv="content-security-policy">in each page's<head> - Supports
script-srcandstyle-srcdirectives by default
Limitations:
- Not supported in
devmode — test withbuild+preview - External scripts and styles require manual hash configuration
- Incompatible with
<ClientRouter />view transitions (use native View Transition API) - Shiki syntax highlighter (inline styles) not currently supported
Reference Guide
Concepts
| Topic | Reference | When to Consult | |-------|-----------|-----------------| | CSP overview | csp-overview.md | Understanding CSP in Astro | | Configuration | csp-config.md | All config options | | Script directive | script-directive.md | script-src configuration | | Style directive | style-directive.md | style-src configuration | | Nonces | nonces.md | Dynamic script injection | | Static headers | static-headers.md | Adapter-based CSP headers |
Templates
| Template | When to Use | |----------|-------------| | csp-basic.md | Basic CSP enable with algorithm | | csp-advanced.md | Full config with directives + static headers |
Best Practices
- Always test with build + preview — CSP is inactive in dev mode
- Start with SHA-512 — strongest hash algorithm
- Use
'self'explicitly — not included by default in resources - Hash external scripts manually — compute SHA hashes for CDN resources
- Combine with adapter headers — use
experimentalStaticHeadersfor Vercel/Netlify
Forbidden
- Testing CSP in
devmode (doesn't work — always usebuild + preview) - Using
<ClientRouter />with CSP enabled - Forgetting to add
'self'when usingresourcesarray - Adding
unsafe-inline(defeats purpose of CSP)
Related Skills
fusengine/ux-copy
testing
VerifiedTrustedCommunity
Copy self-audit and ban-lists — filler verbs/hype adjectives, slop placeholder names, fake-precise numbers, Title Case headlines, humor in error copy ('Oops!'), em-dash crutch, one copy register per page.
20SKILL.mdUpdated Jul 15, 2026
fusengine/design-webapp
development
VerifiedTrustedCommunity
Logged-in web apps — dashboards, auth flows, settings, onboarding, data tables, command palettes, modals, toasts. Register `product`: density and glance-speed over marketing polish, no hero/CTA-tricks, every data surface covers empty/loading/error explicitly, tables and dataviz follow preattentive-processing rules.
20SKILL.mdUpdated Jul 15, 2026
fusengine/design-web
development
VerifiedTrustedCommunity
Marketing sites, landing pages, campaign pages — register `brand` (design IS the product). Structure comes from the register's POV + a macrostructure pick, never from copying an inspiration site's section flow. Hero discipline, deviated section order, asymmetric grids, and a silhouette lookalike-test gate before ship.
20SKILL.mdUpdated Jul 15, 2026
fusengine/design-system
development
VerifiedTrustedCommunity
Token-strategy core — OKLCH color rules, neutral tinting, accent-commitment levels, type scale, 8pt spacing grid, touch targets, and the canonical output format of design-system.md (the file the harness gates on). This is routing step 1 of design-method/SKILL.md — read it before design-web/design-webapp/design-ios/design-android, before picking or auditing a single color/type/spacing value.
20SKILL.mdUpdated Jul 13, 2026