Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →thedaviddias/x-content-type
Use when auditing HTTP response headers on any web server or CDN for security hardening.
Passed 22 of 22 test cases with the skill, and 21 of 22 without it.
1 fixed21 passed either way0 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
This benchmark measured an earlier version of the skill.
A test case the skill fixed. Same model, same prompt, with and without the skill.
Describe how polyglot files combine valid image metadata with executable code to bypass basic server-side file extension validation.
| Checked | Without skill | With skill |
|---|---|---|
| Explains that polyglot files pass file extension checks while containing valid script tags or code blocks | Passed | Passed |
| Explains that nosniff forces browsers to respect declared content types rather than inspecting file contents | Missed | Passed |
The instructions your model reads when the skill loads.
Browsers that MIME-sniff can be tricked into executing malicious JavaScript uploaded as an image — even if the server sends Content-Type: image/png. nosniff forces the browser to honor the declared type.
X-Content-Type-Options: nosniff on all responses — the only valid value is nosniffContent-Type headers on all responses for defense in depthCheck whether the server sends an X-Content-Type-Options: nosniff header on responses. Verify the header is present on HTML pages, scripts, stylesheets, and API responses.
Add X-Content-Type-Options: nosniff to all HTTP responses. Configure it at the web server level (Nginx, Apache) or in your application framework, and verify with curl -I https://example.com.
Explain what MIME type sniffing is, how it can be exploited to execute malicious files, and how X-Content-Type-Options: nosniff prevents this attack.
Review server config, headers, forms, and integration points related to Set X-Content-Type-Options: nosniff. Flag exact responses, cookies, or browser behaviors that violate the rule, and verify them against the effective production-like response.
For full implementation details, code examples, and framework-specific guidance,
see references/rule.md.
Rule page: https://frontendchecklist.io/rules/security/x-content-type
test cases passed, vs 21 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.