Ensures generated code aligns with security headers and permissions policies.
Install
mkdir -p .claude/skills/security-headers && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/16005" && unzip -o skill.zip -d .claude/skills/security-headers && rm skill.zipInstalls to .claude/skills/security-headers
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Generated code must be aligned with security headers (e.g. no unsave JS eval). The permissions policy is especially relevant when changing any code related with the `navigator` object.Key capabilities
- →Configure `usb=(self)` permission policy.
- →Configure `camera=(self)` permission policy.
- →Configure `clipboard-write=(self)` permission policy.
- →Manage `local-network-access=(self)` permission policy.
- →Build web applications with applied security headers.
- →Preview web applications with production security headers.
How it works
The skill aligns generated code with security headers by configuring specific permission policies for browser features like USB, camera, clipboard-write, and local network access.
Inputs & outputs
When to use security-headers
- →Updating permission policies for navigator features
- →Verifying security headers during build and preview
- →Configuring usb, camera, and clipboard-write permissions
About this skill
Security headers
Preview
Start local server with production build and applied security headers:
yarn workspace @trezor/suite-web preview
Build & Preview
Build web app and run the preview command:
yarn workspace @trezor/suite-web build:preview
or
root level command:
yarn suite:build:web:preview
Security Headers
Permissions-Policy Rationale (Enabled Directives)
usb=(self):packages/connect/src/index-browser.ts(window.navigator.usb.requestDevice(...))packages/transport/src/transports/webusb.browser.ts
camera=(self):packages/suite/src/components/suite/modals/ReduxModal/UserContextModal/QrScannerModal/CameraQRReader.tsx(react-zxingcamera scanner used for QR input)
clipboard-write=(self):packages/dom-utils/src/copyToClipboard.ts(navigator.clipboard.writeText(...))packages/analytics-docs/src/components/AddEventModal/CopyButton.tsxpackages/analytics-docs/src/components/EventCard.tsx
local-network-access=(self):packages/suite/src/hooks/suite/useLocalNetworkAccessPermission.ts(navigator.permissions.query({ name: 'local-network-access' }))packages/connect-web/src/impl/core-in-suite-desktop.ts(permission state check for websocket connectivity error handling)
clipboard-read is intentionally not enabled because current direct usage is test-only (suite/e2e/tests/wallet/receive.test.ts) rather than Suite Web runtime behavior.
Disabled directives (=()) are intentionally blocked because there is no direct web runtime use at this time.
Direct Code References
- Header values source:
packages/suite-web/constants/webSecurityHeaders.ts - Header type constraints:
packages/suite-web/types/securityHeaders.ts
MDN references:
Limitations
- →`clipboard-read` is intentionally not enabled because current direct usage is test-only.
- →Disabled directives (`=()`) are intentionally blocked because there is no direct web runtime use at this time.
How it compares
This skill explicitly manages browser permission policies for sensitive `navigator` object features, providing a structured approach to security header configuration compared to manual or ad-hoc adjustments.
Compared to similar skills
security-headers side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| security-headers (this skill) | 0 | 3mo | No flags | Intermediate |
| fix-dependabot-alerts | 18 | 6mo | Review | Intermediate |
| security-audit | 3 | 6mo | Review | Intermediate |
| security-scanning-security-sast | 2 | 4mo | Review | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by trezor
View all by trezor →You might also like
fix-dependabot-alerts
microsoft
Fix Dependabot security alerts by updating vulnerable npm dependencies. Use when the user mentions "dependabot", "security alerts", "vulnerability", "CVE", or wants to update packages with security issues.
security-audit
ruvnet
Comprehensive security scanning and vulnerability detection. Includes input validation, path traversal prevention, CVE detection, and secure coding pattern enforcement. Use when: authentication implementation, authorization logic, payment processing, user data handling, API endpoint creation, file upload handling, database queries, external API integration. Skip when: read-only operations on public data, internal development tooling, static documentation, styling changes.
security-scanning-security-sast
sickn33
Static Application Security Testing (SAST) for code vulnerability analysis across multiple languages and frameworks
middleware-protection
dadbodgeoff
Protect routes with Next.js middleware. Check authentication once, protect routes declaratively. Supports public routes, protected routes, and role-based access.
scanning-for-xss-vulnerabilities
jeremylongshore
Execute this skill enables AI assistant to automatically scan for xss (cross-site scripting) vulnerabilities in code. it is triggered when the user requests to "scan for xss vulnerabilities", "check for xss", or uses the command "/xss". the skill identifies ref... Use when appropriate context detected. Trigger with relevant phrases based on skill purpose.
security-scan
redpanda-data
Resolve npm dependency vulnerabilities detected by security scans.