Astro security

Skill fusengine/agents/plugins/astro-expert/skills/astro-security

Redefining development through cognitive automation and collaborative agent systems.

Install

npx -y skills add fusengine/agents --skill astro-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

22 stars22 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use when configuring Content Security Policy (CSP) in Astro 7, setting security headers, managing script/style hashes, using nonces, or implementing experimentalStaticHeaders for adapter deployments.

SKILL.md

3.5 KB, 712 tokens by cl100k_base, as published. Nobody here has run it

Astro Security

Agent Workflow (MANDATORY)

Before ANY implementation, use TeamCreate to spawn 3 agents:

fuse-ai-pilot:explore-codebase - Analyze existing security config, adapters, headers
fuse-ai-pilot:research-expert - Verify latest Astro 7 CSP docs via Context7/Exa
mcp__context7__query-docs - Check CSP compatibility with deployment adapter

After implementation, run fuse-ai-pilot:sniper for validation.

Overview

When to Use

Enabling CSP in an Astro project (stable in v6.0.0)
Configuring security.csp in astro.config.mjs
Adding SHA-256/384/512 hashes for external scripts or styles
Using nonces for dynamic script injection
Setting up experimentalStaticHeaders for adapter-based CSP headers

CSP in Astro

Astro 6 ships Content Security Policy as a stable feature (previously experimental). When enabled:

Astro automatically generates SHA hashes for all bundled scripts and styles
Injects a <meta http-equiv="content-security-policy"> in each page's <head>
Supports script-src and style-src directives by default

Limitations:

Not supported in dev mode — test with build + preview
External scripts and styles require manual hash configuration
Incompatible with <ClientRouter /> view transitions (use native View Transition API)
Shiki syntax highlighter (inline styles) not currently supported

Reference Guide

Concepts

Topic	Reference	When to Consult
CSP overview	csp-overview.md	Understanding CSP in Astro
Configuration	csp-config.md	All config options
Script directive	script-directive.md	script-src configuration
Style directive	style-directive.md	style-src configuration
Nonces	nonces.md	Dynamic script injection
Static headers	static-headers.md	Adapter-based CSP headers

Templates

Template	When to Use
csp-basic.md	Basic CSP enable with algorithm
csp-advanced.md	Full config with directives + static headers

Best Practices

Always test with build + preview — CSP is inactive in dev mode
Start with SHA-512 — strongest hash algorithm
Use 'self' explicitly — not included by default in resources
Hash external scripts manually — compute SHA hashes for CDN resources
Combine with adapter headers — use experimentalStaticHeaders for Vercel/Netlify

Forbidden

Testing CSP in dev mode (doesn't work — always use build + preview)
Using <ClientRouter /> with CSP enabled
Forgetting to add 'self' when using resources array
Adding unsafe-inline (defeats purpose of CSP)