An automated utility to analyze web resources and generate secure Content Security Policy headers to mitigate XSS vulnerabilities.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install csp-gen
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install csp-gen using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is CSP Generator?
CSP Generator simplifies the complex task of writing Content Security Policy headers. By analyzing a target URL, it identifies all external and internal resources—including scripts, styles, and images—to produce a robust policy that hardens your site against Cross-Site Scripting (XSS). This tool is a vital part of the Openclaw Skills ecosystem for developers who want to prioritize security without diving deep into the technical specifications of every CSP directive.
By automating the discovery of resource origins, the generator ensures that your site remains functional while significantly reducing the attack surface for malicious injections. It removes the guesswork from security configuration, making it accessible to developers of all skill levels.
CSP Generator Use Cases
- Implementing CSP headers for the first time on a production site
- Tightening loose security policies identified during a security audit
- Updating existing policies after adding new third-party scripts or APIs
- Testing security configurations in local development environments
How CSP Generator Works
- The tool crawls the specified URL to identify all loaded resources and their origins.
- It maps these resources to specific CSP directives like script-src, style-src, and img-src.
- An AI-driven analysis balances security strictness with site functionality to minimize breakage.
- It generates a complete CSP header string, including options for report-only mode and nonces.
CSP Generator Setup
To use this tool within the Openclaw Skills framework, ensure you have Node.js 18+ installed. No permanent installation is required; you can run it directly via npx.
npx ai-csp https://mysite.com
For help with available flags:
npx ai-csp --help
CSP Generator Data Schema & Taxonomy
The tool outputs structured policy strings and configuration recommendations as part of the Openclaw Skills suite.
| Field | Description |
|---|---|
| Directives | Mapped resource origins (e.g., script-src, style-src) |
| Policy String | The final raw CSP header value |
| Report-URI | Suggested endpoint for monitoring policy violations |
| Suggestions | Recommendations for nonces and report-only deployment |
CSP Generator Advanced Features
- Support for local development environment analysis (localhost)
- Generation of both strict and relaxed policy variants
- Integration with report-only mode for safe deployment testing
- Automated mapping for complex third-party resource dependencies
SKILL.md
Loading
Related Openclaw Skills
Cron Writer
Transform natural language descriptions into precise cron syntax with AI-powered validation and next-run previews.
Coverage Booster
An automated tool that scans source code to identify coverage gaps and generates ready-to-run unit tests.
Cover Letter Generator
An AI-powered CLI tool that generates customized, role-specific cover letters in seconds.
CORS Generator (cors-gen)
A CLI-based utility that generates precise CORS middleware and configurations from plain English descriptions of your tech stack.
CSS to Tailwind Converter
Automatically convert vanilla CSS files into Tailwind CSS utility classes using AI-driven mapping.
CSVKit Next
A high-performance, zero-dependency CLI toolkit for filtering, transforming, merging, and analyzing CSV data at scale.
Featured*
