A powerful tool to automatically scan your codebase and generate accurate Content Security Policy (CSP) headers to secure your web applications.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install ai-csp
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install ai-csp using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is CSP Generator (csp-gen)?
The CSP Generator (csp-gen) is a developer-centric skill designed to eliminate the trial-and-error approach to building Content Security Policies. By scanning your source files and public assets, it identifies external dependencies, scripts, styles, and images to construct a functional CSP that balances security and site functionality. As part of the Openclaw Skills ecosystem, this tool simplifies the process of hardening your web applications against cross-site scripting (XSS) and data injection attacks without breaking site features.
CSP Generator (csp-gen) Use Cases
- Securing a new web application with a baseline CSP before deployment.
- Auditing existing projects to identify hidden external resource dependencies.
- Generating strict CSP rules for high-security environments using automated scanning.
- Creating platform-specific configurations like Next.js or Nginx headers without manual entry.
How CSP Generator (csp-gen) Works
- The tool initiates a deep scan of the specified source directory (e.g., ./src or ./public).
- It analyzes the code to find external script sources, stylesheets, and image URLs.
- It detects inline scripts and styles that require cryptographic hashes or nonces.
- It compiles these findings into a comprehensive CSP string based on user-defined strictness levels.
- Finally, it outputs the policy in the requested format, such as an HTTP header or an HTML meta tag.
CSP Generator (csp-gen) Setup
Ensure you have Node.js 18+ installed and an OPENAI_API_KEY configured in your environment. You can run the skill directly via npx:
npx ai-csp ./src
To generate a strict policy for a production environment, use:
npx ai-csp ./src --strict
CSP Generator (csp-gen) Data Schema & Taxonomy
The skill processes your local source files and produces structured security configurations. Below is the primary output taxonomy:
| Format | Output Type | Description |
|---|---|---|
| HTTP Header | String | Standard Content-Security-Policy header text. |
| Meta Tag | HTML | meta tag for inclusion in HTML head section. |
| Next.js | JSON/JS | Configuration object compatible with next.config.js. |
| Nginx | Config | Snippet for use within nginx.conf header directives. |
CSP Generator (csp-gen) Advanced Features
- Multi-format output support including Next.js and Nginx configuration snippets.
- Strict mode toggle to enforce higher security standards during the automated scanning process.
- Automatic identification and hashing of inline scripts to meet modern CSP requirements.
- Detailed explanations provided for each generated directive to help developers learn security best practices within Openclaw Skills.
SKILL.md
Loading
Related Openclaw Skills
Cron Generator
A command-line utility that transforms natural language descriptions into valid cron expressions and human-readable explanations.
Coverage Boost
An AI-driven tool that analyzes code coverage gaps and generates targeted unit tests to improve software reliability.
Core Vitals Fixer
An AI-powered diagnostic tool that scans your source code to identify and provide actionable fixes for Core Web Vitals performance bottlenecks.
Compound Engineering
A self-improving memory framework that enables AI agents to review their work, extract patterns, and compound knowledge daily.
CSS to Tailwind
An AI-powered utility that converts legacy CSS files into optimized Tailwind CSS utility classes while preserving complex selectors and media queries.
Deps Analyzer
A zero-config AI tool that identifies unused dependencies and flags security vulnerabilities to optimize your package.json.
METADATA
Featured*
