How do I install the Astro Security skill?

Run npx skillmds@latest add fusengine/astro-security-3 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Astro Security safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Astro Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Astro Security free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Astro Security?

fusengine (@fusengine) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Astro Security by fusengine — Agent Skill

Name: Astro Security
Rating: 4.2 (5 reviews)
Author: fusengine

File contents

Astro Security

Agent Workflow (MANDATORY)

Before ANY implementation, use TeamCreate to spawn 3 agents:

fuse-ai-pilot:explore-codebase - Analyze existing security config, adapters, headers
fuse-ai-pilot:research-expert - Verify latest Astro 6 CSP docs via Context7/Exa
mcp__context7__query-docs - Check CSP compatibility with deployment adapter

After implementation, run fuse-ai-pilot:sniper for validation.

Overview

When to Use

Enabling CSP in an Astro 6 project (stable in v6.0.0)
Configuring security.csp in astro.config.mjs
Adding SHA-256/384/512 hashes for external scripts or styles
Using nonces for dynamic script injection
Setting up experimentalStaticHeaders for adapter-based CSP headers

CSP in Astro 6

Astro 6 ships Content Security Policy as a stable feature (previously experimental). When enabled:

Astro automatically generates SHA hashes for all bundled scripts and styles
Injects a <meta http-equiv="content-security-policy"> in each page's <head>
Supports script-src and style-src directives by default

Limitations:

Not supported in dev mode — test with build + preview
External scripts and styles require manual hash configuration
Incompatible with <ClientRouter /> view transitions (use native View Transition API)
Shiki syntax highlighter (inline styles) not currently supported

Reference Guide

Concepts

Topic	Reference	When to Consult
CSP overview	csp-overview.md	Understanding CSP in Astro 6
Configuration	csp-config.md	All config options
Script directive	script-directive.md	script-src configuration
Style directive	style-directive.md	style-src configuration
Nonces	nonces.md	Dynamic script injection
Static headers	static-headers.md	Adapter-based CSP headers

Templates

Template	When to Use
csp-basic.md	Basic CSP enable with algorithm
csp-advanced.md	Full config with directives + static headers

Best Practices

Always test with build + preview — CSP is inactive in dev mode
Start with SHA-512 — strongest hash algorithm
Use 'self' explicitly — not included by default in resources
Hash external scripts manually — compute SHA hashes for CDN resources
Combine with adapter headers — use experimentalStaticHeaders for Vercel/Netlify

Forbidden

Testing CSP in dev mode (doesn't work — always use build + preview)
Using <ClientRouter /> with CSP enabled
Forgetting to add 'self' when using resources array
Adding unsafe-inline (defeats purpose of CSP)

---name: astro-security-3description: Use when configuring Content Security Policy (CSP) in Astro 6, setting security headers, managing script/style hashes, using nonces, or implementing experimentalStaticHeaders for adapter deployments.---# Astro Security## Agent Workflow (MANDATORY)Before ANY implementation, use `TeamCreate` to spawn 3 agents:1. **fuse-ai-pilot:explore-codebase** - Analyze existing security config, adapters, headers2. **fuse-ai-pilot:research-expert** - Verify latest Astro 6 CSP docs via Context7/Exa3. **mcp__context7__query-docs** - Check CSP compatibility with deployment adapterAfter implementation, run **fuse-ai-pilot:sniper** for validation.---## Overview### When to Use- Enabling CSP in an Astro 6 project (stable in v6.0.0)- Configuring `security.csp` in `astro.config.mjs`- Adding SHA-256/384/512 hashes for external scripts or styles- Using nonces for dynamic script injection- Setting up `experimentalStaticHeaders` for adapter-based CSP headers### CSP in Astro 6Astro 6 ships Content Security Policy as a **stable** feature (previously experimental). When enabled:- Astro automatically generates SHA hashes for all bundled scripts and styles- Injects a `<meta http-equiv="content-security-policy">` in each page's `<head>`- Supports `script-src` and `style-src` directives by default**Limitations:**- Not supported in `dev` mode — test with `build` + `preview`- External scripts and styles require manual hash configuration- Incompatible with `<ClientRouter />` view transitions (use native View Transition API)- Shiki syntax highlighter (inline styles) not currently supported---## Reference Guide### Concepts| Topic | Reference | When to Consult ||-------|-----------|-----------------|| CSP overview | [csp-overview.md](references/csp-overview.md) | Understanding CSP in Astro 6 || Configuration | [csp-config.md](references/csp-config.md) | All config options || Script directive | [script-directive.md](references/script-directive.md) | script-src configuration || Style directive | [style-directive.md](references/style-directive.md) | style-src configuration || Nonces | [nonces.md](references/nonces.md) | Dynamic script injection || Static headers | [static-headers.md](references/static-headers.md) | Adapter-based CSP headers |### Templates| Template | When to Use ||----------|-------------|| [csp-basic.md](references/templates/csp-basic.md) | Basic CSP enable with algorithm || [csp-advanced.md](references/templates/csp-advanced.md) | Full config with directives + static headers |---## Best Practices1. **Always test with build + preview** — CSP is inactive in dev mode2. **Start with SHA-512** — strongest hash algorithm3. **Use `'self'` explicitly** — not included by default in resources4. **Hash external scripts manually** — compute SHA hashes for CDN resources5. **Combine with adapter headers** — use `experimentalStaticHeaders` for Vercel/Netlify---## Forbidden- Testing CSP in `dev` mode (doesn't work — always use `build + preview`)- Using `<ClientRouter />` with CSP enabled- Forgetting to add `'self'` when using `resources` array- Adding `unsafe-inline` (defeats purpose of CSP)

Frequently asked questions

Astro Security

File contents

Astro Security

Agent Workflow (MANDATORY)

Overview

When to Use

CSP in Astro 6

Reference Guide

Concepts

Templates

Best Practices

Forbidden

Related skills

Frequently asked questions

How do I install the Astro Security skill?

What does the Astro Security skill do?

Is Astro Security safe to use?

Which AI agents work with Astro Security?

Is Astro Security free to use?

Who published Astro Security?