Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-conf-12
Test for Content Security Policy
Passed 22 of 22 test cases with the skill, and 19 of 22 without it.
and 2 more in the full report
3 fixed19 passed either way0 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
What standardized CVSS base scores apply when auditing web applications that lack any CSP header versus applications that only implement Content-Security-Policy-Report-Only?
| Checked | Without skill | With skill |
|---|---|---|
| Assigns CVSS score 6.1 when no CSP header is present. | Missed | Passed |
| Assigns CVSS score 3.7 when only report-only mode is configured. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-CONF-12
Test for Content Security Policy (CSP)
Content Security Policy (CSP) is a security mechanism that helps prevent cross-site scripting (XSS), clickjacking, and other code injection attacks. CSP defines which sources of content are allowed to be loaded and executed by the browser. This test evaluates whether CSP is implemented correctly and identifies misconfigurations that could allow attackers to bypass the policy.
| Directive | Risk | Description |
|---|---|---|
unsafe-inline | High | Allows inline scripts/styles (XSS) |
unsafe-eval | High | Allows eval() function |
unsafe-hashes | Medium | Allows specific inline scripts |
* wildcard | High | Allows any source |
data: | Medium | Allows data URLs |
blob: | Medium | Allows blob URLs |
Missing frame-ancestors | Medium | Clickjacking possible |
| Directive | Purpose |
test cases passed, vs 19 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.