060101 http security

Skill natuleadan/skills/skills/060101-http-security

Multi-domain agent skills collection for AI coding agents (Claude, Cursor, Copilot, OpenCode, and more). Covers programming, biology, cooking, and future domains. Installable via npx skills add.

Install

npx -y skills add natuleadan/skills --skill 060101-http-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Multi-layer web security patterns — rate limiting, Content Security Policy, security headers, CORS, IP deny lists, and graceful degradation.

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.0 KB, 718 tokens by cl100k_base, as published. Nobody here has run it

Security Patterns

Architecture Overview

Security is applied at three layers:

1. Edge/Proxy Layer    ← Rate limiting, CSP, security headers, IP deny
2. Application Layer   ← Auth rate limit, session validation, input sanitization
3. Infrastructure Layer ← Auto-protection, firewall, DDoS mitigation

Layer 1: Edge/Proxy

Rate Limiting

Applied before requests reach application code.

Algorithm: Fixed window (cheaper) or sliding window (stricter)
Identifier: Client IP (x-forwarded-for → x-real-ip)
Tiers: Different limits per route group (auth, api, public)

Request → match route tier → ratelimit.limit(ip) → pass or 429
                              ↓ (timeout → allow on failure)
                        Application handler

Content Security Policy (CSP)

Dynamic CSP built from environment variables:

Directive	Purpose	Configurable via
`script-src`	Allowed JS sources	CSP_SCRIPT_SRC_DOMAINS
`style-src`	Allowed CSS sources	CSP_STYLE_SRC_DOMAINS
`img-src`	Allowed image sources	CSP_IMG_SRC_DOMAINS
`font-src`	Allowed font sources	CSP_FONT_SRC_DOMAINS
`connect-src`	Allowed API/WS connections	CSP_CONNECT_SRC_DOMAINS
`frame-src`	Allowed iframe sources	CSP_FRAME_SRC_DOMAINS

Security Headers

Header	Value
`X-Content-Type-Options`	`nosniff`
`X-Frame-Options`	`SAMEORIGIN`
`X-XSS-Protection`	`1; mode=block`
`Referrer-Policy`	`strict-origin-when-cross-origin`
`Permissions-Policy`	`camera=(self), microphone=(self), geolocation=(self)`
`Strict-Transport-Security`	`max-age=31536000; includeSubDomains; preload`

Layer 2: Application

Auth rate limits (e.g., 10 req/60s on login endpoints)
Session validation on every protected action
Input sanitization (XSS prevention)
CSRF tokens on mutations

Layer 3: Infrastructure

Auto IP deny list from open-source threat feeds
DDoS protection at cloud provider level
Database connection limits and query timeouts

Graceful Degradation

If the rate limiting service is unreachable:

Timeout (e.g., 1s) triggers catch clause
Request is allowed through (fail open)
Security headers still applied
Next request retries — resumes when service is back

Quick Reference

# Test security headers
curl -I https://example.com | grep -i "x-\|strict-\|referrer-\|permissions-"

# Test rate limiting
for i in $(seq 1 20); do curl -s -o /dev/null -w "%{http_code}\n" https://example.com/api/endpoint; done

References

Security Patterns
Rate Limiting
Request Headers
Environment Variables — Secret generation, rotation, .env hierarchy

What ships with it: 6 files

9.3 KB alongside SKILL.md, 1 of them executable

references/

scripts/

validate.pyruns2.4 KB

metadata.json714 B