How do I install the HTTP Sec Audit skill?

Run npx skillmds@latest add luokai0/http-sec-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is HTTP Sec Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: executes scripts, makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with HTTP Sec Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is HTTP Sec Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published HTTP Sec Audit?

luokai0 (@luokai0) published this skill. Their other Agent Skills are listed on their SkillMD profile.

HTTP Sec Audit by luokai0 — Agent Skill

Name: HTTP Sec Audit
Rating: 4.2 (5 reviews)
Author: luokai0

HTTP Sec Audit

Audit HTTP security headers for any website. Use when a user asks to check security headers, harden a web server, audit HSTS/CSP/X-Frame-Options compliance, find information leaks (Server, X-Powered-By), or assess a website's security posture. Checks 10 security headers and grades A–F. Supports multiple URLs and JSON output.

luokai0 Updated Sep 9, 2026 10 repo stars

File contents

HTTP Security Headers Audit

Scan any URL for missing or misconfigured security headers and get an actionable report with grades, fix recommendations, and info-leak detection.

Quick Start

python3 scripts/sec_headers.py https://example.com

Commands

# Single URL audit
python3 scripts/sec_headers.py https://example.com

# Multiple URLs
python3 scripts/sec_headers.py https://example.com https://google.com https://github.com

# JSON output (for programmatic use)
python3 scripts/sec_headers.py https://example.com --json

# Custom timeout
python3 scripts/sec_headers.py https://example.com --timeout 5

What It Checks

Security headers (graded by severity):

Strict-Transport-Security (HSTS) — HIGH
Content-Security-Policy (CSP) — HIGH
X-Content-Type-Options — MEDIUM
X-Frame-Options — MEDIUM
Referrer-Policy — MEDIUM
Permissions-Policy — MEDIUM
X-XSS-Protection — LOW
Cross-Origin-Opener-Policy (COOP) — LOW
Cross-Origin-Resource-Policy (CORP) — LOW
Cross-Origin-Embedder-Policy (COEP) — LOW

Info leak detection:

Server header (software version disclosure)
X-Powered-By (technology stack leak)
X-AspNet-Version (framework version leak)

Grading

Grade	Score	Meaning
A	90–100	Excellent — all critical headers present
B	75–89	Good — minor gaps
C	50–74	Fair — important headers missing
D	25–49	Poor — significant exposure
F	0–24	Failing — most headers absent

Dependencies

pip install requests

---name: http-sec-auditdescription: Audit HTTP security headers for any website. Use when a user asks to check security headers, harden a web server, audit HSTS/CSP/X-Frame-Options compliance, find information leaks (Server, X-Powered-By), or assess a website's security posture. Checks 10 security headers and grades A–F. Supports multiple URLs and JSON output.--- # HTTP Security Headers Audit Scan any URL for missing or misconfigured security headers and get an actionable report with grades, fix recommendations, and info-leak detection. ## Quick Start ```bash python3 scripts/sec_headers.py https://example.com ``` ## Commands ```bash # Single URL audit python3 scripts/sec_headers.py https://example.com # Multiple URLs python3 scripts/sec_headers.py https://example.com https://google.com https://github.com # JSON output (for programmatic use) python3 scripts/sec_headers.py https://example.com --json # Custom timeout python3 scripts/sec_headers.py https://example.com --timeout 5 ``` ## What It Checks **Security headers** (graded by severity): - `Strict-Transport-Security` (HSTS) — HIGH - `Content-Security-Policy` (CSP) — HIGH - `X-Content-Type-Options` — MEDIUM - `X-Frame-Options` — MEDIUM - `Referrer-Policy` — MEDIUM - `Permissions-Policy` — MEDIUM - `X-XSS-Protection` — LOW - `Cross-Origin-Opener-Policy` (COOP) — LOW - `Cross-Origin-Resource-Policy` (CORP) — LOW - `Cross-Origin-Embedder-Policy` (COEP) — LOW **Info leak detection:** - `Server` header (software version disclosure) - `X-Powered-By` (technology stack leak) - `X-AspNet-Version` (framework version leak) ## Grading | Grade | Score | Meaning | |-------|-------|---------| | A | 90–100 | Excellent — all critical headers present | | B | 75–89 | Good — minor gaps | | C | 50–74 | Fair — important headers missing | | D | 25–49 | Poor — significant exposure | | F | 0–24 | Failing — most headers absent | ## Dependencies ```bash pip install requests ```

Frequently asked questions