How do I install the HTTP Sec Audit skill?

Run npx skillmds@latest add dvcrn/http-sec-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is HTTP Sec Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: executes scripts, makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with HTTP Sec Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is HTTP Sec Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published HTTP Sec Audit?

dvcrn (@dvcrn) published this skill. Their other Agent Skills are listed on their SkillMD profile.

HTTP Sec Audit by dvcrn — Agent Skill

Name: HTTP Sec Audit
Rating: 4.666666666666667 (3 reviews)
Author: dvcrn

HTTP Sec Audit

Audit HTTP security headers for any website. Use when a user asks to check security headers, harden a web server, audit HSTS/CSP/X-Frame-Options compliance, find information leaks (Server, X-Powered-By), or assess a website's security posture. Checks 10 security headers and grades A–F. Supports multiple URLs and JSON output.

dvcrn Updated Sep 8, 2026 32 repo stars

File contents

HTTP Security Headers Audit

Scan any URL for missing or misconfigured security headers and get an actionable report with grades, fix recommendations, and info-leak detection.

Quick Start

python3 scripts/sec_headers.py https://example.com

Commands

# Single URL audit
python3 scripts/sec_headers.py https://example.com

# Multiple URLs
python3 scripts/sec_headers.py https://example.com https://google.com https://github.com

# JSON output (for programmatic use)
python3 scripts/sec_headers.py https://example.com --json

# Custom timeout
python3 scripts/sec_headers.py https://example.com --timeout 5

What It Checks

Security headers (graded by severity):

Strict-Transport-Security (HSTS) — HIGH
Content-Security-Policy (CSP) — HIGH
X-Content-Type-Options — MEDIUM
X-Frame-Options — MEDIUM
Referrer-Policy — MEDIUM
Permissions-Policy — MEDIUM
X-XSS-Protection — LOW
Cross-Origin-Opener-Policy (COOP) — LOW
Cross-Origin-Resource-Policy (CORP) — LOW
Cross-Origin-Embedder-Policy (COEP) — LOW

Info leak detection:

Server header (software version disclosure)
X-Powered-By (technology stack leak)
X-AspNet-Version (framework version leak)

Grading

Grade	Score	Meaning
A	90–100	Excellent — all critical headers present
B	75–89	Good — minor gaps
C	50–74	Fair — important headers missing
D	25–49	Poor — significant exposure
F	0–24	Failing — most headers absent

Dependencies

pip install requests

---name: http-sec-auditdescription: Audit HTTP security headers for any website. Use when a user asks to check security headers, harden a web server, audit HSTS/CSP/X-Frame-Options compliance, find information leaks (Server, X-Powered-By), or assess a website's security posture. Checks 10 security headers and grades A–F. Supports multiple URLs and JSON output.---# HTTP Security Headers AuditScan any URL for missing or misconfigured security headers and get an actionable report with grades, fix recommendations, and info-leak detection.## Quick Start```bashpython3 scripts/sec_headers.py https://example.com```## Commands```bash# Single URL auditpython3 scripts/sec_headers.py https://example.com# Multiple URLspython3 scripts/sec_headers.py https://example.com https://google.com https://github.com# JSON output (for programmatic use)python3 scripts/sec_headers.py https://example.com --json# Custom timeoutpython3 scripts/sec_headers.py https://example.com --timeout 5```## What It Checks**Security headers** (graded by severity):- `Strict-Transport-Security` (HSTS) — HIGH- `Content-Security-Policy` (CSP) — HIGH- `X-Content-Type-Options` — MEDIUM- `X-Frame-Options` — MEDIUM- `Referrer-Policy` — MEDIUM- `Permissions-Policy` — MEDIUM- `X-XSS-Protection` — LOW- `Cross-Origin-Opener-Policy` (COOP) — LOW- `Cross-Origin-Resource-Policy` (CORP) — LOW- `Cross-Origin-Embedder-Policy` (COEP) — LOW**Info leak detection:**- `Server` header (software version disclosure)- `X-Powered-By` (technology stack leak)- `X-AspNet-Version` (framework version leak)## Grading| Grade | Score | Meaning ||-------|-------|---------|| A | 90–100 | Excellent — all critical headers present || B | 75–89 | Good — minor gaps || C | 50–74 | Fair — important headers missing || D | 25–49 | Poor — significant exposure || F | 0–24 | Failing — most headers absent |## Dependencies```bashpip install requests```

Frequently asked questions