How do I install the Csp Gen skill?

Run npx skillmds@latest add demerzels-lab/csp-gen in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Csp Gen safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Csp Gen?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Csp Gen free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Csp Gen?

Demerzels-lab (@demerzels-lab) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Csp Gen by demerzels-lab — Agent Skill

Name: Csp Gen
Author: Demerzels-lab

File contents

CSP Generator

Content Security Policy headers are one of the best defenses against XSS attacks. But writing them is confusing. This tool analyzes your site and generates the right CSP headers automatically. No more guessing which directives you need or accidentally blocking your own scripts.

One command. Zero config. Just works.

Quick Start

npx ai-csp https://mysite.com

What It Does

Analyzes your site to determine which resources are loaded and from where
Generates a complete Content-Security-Policy header string
Handles script-src, style-src, img-src, connect-src, and all other directives
Suggests report-uri configuration for monitoring violations
Outputs both strict and relaxed policy options

Usage Examples

# Generate CSP for a production site
npx ai-csp https://mysite.com

# Generate CSP for local development
npx ai-csp http://localhost:3000

# Analyze a specific page
npx ai-csp https://mysite.com/dashboard

Best Practices

Start with report-only mode - Deploy with Content-Security-Policy-Report-Only first to see what would break
Avoid unsafe-inline - If your CSP has unsafe-inline in script-src, it's barely doing anything
Use nonces for inline scripts - Much safer than unsafe-inline and works with most frameworks
Test on all pages - Different pages might load different resources. Generate and merge policies.

When to Use This

You're adding CSP headers for the first time and don't know where to start
Your current CSP is too loose and you want to tighten it
You added new third party scripts and need to update your policy
Security audit flagged missing or weak CSP headers

Part of the LXGIC Dev Toolkit

This is one of 110+ free developer tools built by LXGIC Studios. No paywalls, no sign-ups, no API keys on free tiers. Just tools that work.

Find more:

GitHub: https://github.com/LXGIC-Studios
Twitter: https://x.com/lxgicstudios
Substack: https://lxgicstudios.substack.com
Website: https://lxgic.dev

Requirements

No install needed. Just run with npx. Node.js 18+ recommended.

npx ai-csp --help

How It Works

The tool analyzes your site's resources by checking which scripts, styles, images, and APIs are loaded. It maps these to the appropriate CSP directives and generates a complete policy string. AI is used to recommend the right balance between security and functionality.

License

MIT. Free forever. Use it however you want.

---name: csp-gendescription: Generate Content Security Policy headers for your site. Use when you need to add CSP headers without spending hours reading the spec.---# CSP GeneratorContent Security Policy headers are one of the best defenses against XSS attacks. But writing them is confusing. This tool analyzes your site and generates the right CSP headers automatically. No more guessing which directives you need or accidentally blocking your own scripts.**One command. Zero config. Just works.**## Quick Start```bashnpx ai-csp https://mysite.com```## What It Does- Analyzes your site to determine which resources are loaded and from where- Generates a complete Content-Security-Policy header string- Handles script-src, style-src, img-src, connect-src, and all other directives- Suggests report-uri configuration for monitoring violations- Outputs both strict and relaxed policy options## Usage Examples```bash# Generate CSP for a production sitenpx ai-csp https://mysite.com# Generate CSP for local developmentnpx ai-csp http://localhost:3000# Analyze a specific pagenpx ai-csp https://mysite.com/dashboard```## Best Practices- **Start with report-only mode** - Deploy with Content-Security-Policy-Report-Only first to see what would break- **Avoid unsafe-inline** - If your CSP has unsafe-inline in script-src, it's barely doing anything- **Use nonces for inline scripts** - Much safer than unsafe-inline and works with most frameworks- **Test on all pages** - Different pages might load different resources. Generate and merge policies.## When to Use This- You're adding CSP headers for the first time and don't know where to start- Your current CSP is too loose and you want to tighten it- You added new third party scripts and need to update your policy- Security audit flagged missing or weak CSP headers## Part of the LXGIC Dev ToolkitThis is one of 110+ free developer tools built by LXGIC Studios. No paywalls, no sign-ups, no API keys on free tiers. Just tools that work.**Find more:**- GitHub: https://github.com/LXGIC-Studios- Twitter: https://x.com/lxgicstudios- Substack: https://lxgicstudios.substack.com- Website: https://lxgic.dev## RequirementsNo install needed. Just run with npx. Node.js 18+ recommended.```bashnpx ai-csp --help```## How It WorksThe tool analyzes your site's resources by checking which scripts, styles, images, and APIs are loaded. It maps these to the appropriate CSP directives and generates a complete policy string. AI is used to recommend the right balance between security and functionality.## LicenseMIT. Free forever. Use it however you want.

Frequently asked questions

Csp Gen