# Content Type Sniffing Vulnerability

> Detects missing X-Content-Type-Options header and incorrect Content-Type that allows MIME sniffing attacks.

- Skill: `zakirkun/content-type-sniffing-vulnerability` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/content-type-sniffing-vulnerability`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/content-type-sniffing-vulnerability/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/content-type-sniffing-vulnerability

---


# Content Type Sniffing

## Overview
Browsers that MIME-sniff responses can interpret uploaded files differently from the declared content type. An attacker uploads an HTML file disguised as an image, and the browser sniffs it as HTML and executes the embedded JavaScript.

`X-Content-Type-Options: nosniff` prevents this sniffing behavior.

## Remediation
- Set `X-Content-Type-Options: nosniff` on all responses
- Always declare the correct Content-Type for served files
- Do not serve user-uploaded content from the same origin as the application