{"slug":"jeremylongshore-checking-http-security-headers","source_name":"jeremylongshore/checking-http-security-headers","name":"Jeremylongshore/Checking HTTP Security Headers","description":"Audit a target's HTTP security headers — CSP, HSTS, X-Frame-Options,\nX-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the\nCross-Origin trio (COOP, COEP, CORP).\nUse when: SOC2 / PCI auditor flagged \"missing security headers\" or a\nMozilla Observatory grade is below B, OR you need HSTS preload\neligibility for chrome://net-internals.\nThreshold: any missing required header on production HTML response,\nHSTS max-age below 31536000s (preload requirement), CSP with\n'unsafe-inline' or 'uns","version":1,"lift":{"pass_rate_delta_pts":22.73,"pass_rate_pct":68.2,"total_cases":22,"passed_cases":15,"tokens_delta_pct":41,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-08-13T15:00:44.311332+00:00"},"skill_score":null,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":22.73,"with_pass_pct":68.2,"without_pass_pct":45.5,"tokens_delta_pct":41,"turns_delta_pct":0,"total_cases":22,"cases_aggregated":22,"verdict":"mixed","never_hurt":false,"completed_at":"2026-08-13T15:00:44.311332+00:00","run_id":"2e09da56-eb46-45ea-ac21-ce5274d33ecb","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":"safe","content_status":"clean","indexable":true},"license":"MIT","install_count":0,"manifest_hash":"8b30cccbc797bd30b3ca119ac7ad2f6fbc7bb625741b87767ae7ad13b6c7177c","raw_url":"https://app.decimal.ai/s/jeremylongshore-checking-http-security-headers/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/jeremylongshore-checking-http-security-headers"}