Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Security headers — measured AI agent skill | DecimalAI

trezor/security-headers

SkillScore95Maintained

Generated code must be aligned with security headers (e.g. no unsave JS eval). The permissions policy is especially relevant when changing any code related with the `navigator` object.

Securityby trezor

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/trezor-security-headers/SKILL.md

decimalai skills pull trezor-security-headers --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/trezor-security-headers/SKILL.md https://app.decimal.ai/s/trezor-security-headers/SKILL.md

Raw file: /s/trezor-security-headers/SKILL.md ↗ · machine-readable summary at /s/trezor-security-headers.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 3h ago

Yes — +73% lift-30% tokens0% turns95% of whole cases pass with skill (21/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-06	✗→✓	▲ Improved	-48%	0%
case-01	✗→✓	▲ Improved	-49%	0%
case-02	✗→✓	▲ Improved	-22%	0%
case-03	✗→✓	▲ Improved	-44%	0%
case-04	✗→✓	▲ Improved	-18%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

trezor / trezor-suite

skills/security-headers/SKILL.md

View on GitHub ↗

License NOASSERTIONImported 8/3/2026Version v1

Skill contents

SKILL.md

Security headers

Preview

Start local server with production build and applied security headers:

yarn workspace @trezor/suite-web preview

Build & Preview

Build web app and run the preview command:

yarn workspace @trezor/suite-web build:preview

root level command:

yarn suite:build:web:preview

Security Headers

Permissions-Policy Rationale (Enabled Directives)

usb=(self):
packages/connect/src/index-browser.ts (window.navigator.usb.requestDevice(...))
packages/transport/src/transports/webusb.browser.ts
camera=(self):
packages/suite/src/components/suite/modals/ReduxModal/UserContextModal/QrScannerModal/CameraQRReader.tsx (react-zxing camera scanner used for QR input)
clipboard-write=(self):
packages/dom-utils/src/copyToClipboard.ts (navigator.clipboard.writeText(...))
packages/analytics-docs/src/components/AddEventModal/CopyButton.tsx
packages/analytics-docs/src/components/EventCard.tsx
local-network-access=(self):
packages/suite/src/hooks/suite/useLocalNetworkAccessPermission.ts (navigator.permissions.query({ name: 'local-network-access' }))
packages/connect-web/src/impl/core-in-suite-desktop.ts (permission state check for websocket connectivity error handling)

clipboard-read is intentionally not enabled because current direct usage is test-only (suite/e2e/tests/wallet/receive.test.ts) rather than Suite Web runtime behavior.

Disabled directives (=()) are intentionally blocked because there is no direct web runtime use at this time.

Direct Code References

Header values source: packages/suite-web/constants/webSecurityHeaders.ts
Header type constraints: packages/suite-web/types/securityHeaders.ts

MDN references:

Want to see if trezor/security-headers would activate on your phrasing? Try it before you install — no LLM call, no signup.

Other measured skills in the registry, with their headline benchmark lift.