A specialized security utility to generate, validate, and refine Content Security Policy (CSP) headers through automated resource discovery and risk analysis.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install csp-policy-generator
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install csp-policy-generator using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is CSP Policy Generator?
The CSP Policy Generator is a technical tool designed to simplify the complex process of implementing Content Security Policies. By utilizing Openclaw Skills to crawl your web application, it identifies every resource origin—including scripts, styles, images, and fonts—to build a least-privilege security header. This helps developers prevent Cross-Site Scripting (XSS) and clickjacking without accidentally breaking site functionality.
Beyond just generation, this skill provides a structured migration path from report-only mode to full enforcement. It evaluates existing policies for high-risk weaknesses like unsafe-inline directives or overly broad wildcards, ensuring your application adheres to modern security best practices while maintaining a developer-friendly workflow.
CSP Policy Generator Use Cases
- Creating a robust Content Security Policy for a new deployment to prevent XSS.
- Analyzing live web pages to identify and resolve existing CSP violations.
- Transitioning a web application from a report-only security posture to strict enforcement.
- Generating nonce-based or hash-based policies for dynamic frameworks and static sites.
How CSP Policy Generator Works
- The skill analyzes the target host by fetching the HTML and extracting all resource URLs for scripts, styles, and media.
- It scans secondary assets like JavaScript files to detect dynamic resource loading and API connections.
- A least-privilege policy is constructed starting from a default-src 'none' baseline.
- The agent performs a risk assessment to flag dangerous configurations like unsafe-eval or missing clickjacking protection.
- It generates a deployment-ready output including a migration roadmap and specific implementation code.
CSP Policy Generator Setup
To utilize this security tool within the Openclaw Skills ecosystem, ensure you have the necessary CLI utilities installed for resource parsing.
# Ensure python3 and ripgrep are available for analysis
python3 --version
rg --version
# Basic usage involves providing your target host for discovery
# The agent will then execute the generate command sequence
CSP Policy Generator Data Schema & Taxonomy
The skill organizes security data by mapping discovered origins to standard CSP directives as shown below:
| Directive | Target Resources | Metadata Tracked |
|---|---|---|
| script-src | JavaScript files, inline scripts | Hostnames, nonces, hashes |
| style-src | CSS files, inline styles | CDN origins, inline-attribute flags |
| img-src | Images, icons, favicons | Data URIs, external domains |
| connect-src | XHR, Fetch, WebSockets | API endpoints, backend services |
| frame-ancestors | Embedding permissions | Allowed parent origins |
CSP Policy Generator Advanced Features
- Dynamic nonce middleware generation for Express.js applications to replace unsafe-inline scripts.
- Automated SHA-256 hashing for static site inline scripts using OpenSSL.
- Real-time header validation that checks live URLs for policy weaknesses or missing directives.
- Multi-stage migration planning integrated with the Openclaw Skills framework for safer security deployments.
SKILL.md
Loading
Related Openclaw Skills
Service Catalog
An automated infrastructure discovery tool that builds a living service inventory by scanning Docker, Kubernetes, and application configurations.
Secrets Audit
A high-performance security scanner for detecting hardcoded credentials, API keys, and sensitive tokens within codebases and git histories.
Verified Agent Identity
A comprehensive toolkit for AI agents to manage decentralized identities, sign challenges, and establish verifiable links to human owners on the Billions Network.
PR Description Generator
A Python-based tool that automates the creation of structured pull request descriptions by analyzing git diffs and commit history.
GitHub Actions Linter
A specialized linter for GitHub Actions YAML files to detect security risks, deprecated actions, and syntax errors.
Backpressure Analyzer
A diagnostic and optimization tool for detecting processing bottlenecks and implementing flow control in data streaming pipelines.
Featured*
