astro-security

Solid

Use when configuring Content Security Policy (CSP) in Astro 7, setting security headers, managing script/style hashes, using nonces, or implementing experimentalStaticHeaders for adapter deployments.

Web & Frontend 22 stars 3 forks Updated 2 days ago MIT

Install

View on GitHub

Quality Score: 88/100

Stars 20%
45
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

# Astro Security ## Agent Workflow (MANDATORY) Before ANY implementation, use `TeamCreate` to spawn 3 agents: 1. **fuse-ai-pilot:explore-codebase** - Analyze existing security config, adapters, headers 2. **fuse-ai-pilot:research-expert** - Verify latest Astro 7 CSP docs via Context7/Exa 3. **mcp__context7__query-docs** - Check CSP compatibility with deployment adapter After implementation, run **fuse-ai-pilot:sniper** for validation. --- ## Overview ### When to Use - Enabling CSP in an Astro project (stable in v6.0.0) - Configuring `security.csp` in `astro.config.mjs` - Adding SHA-256/384/512 hashes for external scripts or styles - Using nonces for dynamic script injection - Setting up `experimentalStaticHeaders` for adapter-based CSP headers ### CSP in Astro Astro 6 ships Content Security Policy as a **stable** feature (previously experimental). When enabled: - Astro automatically generates SHA hashes for all bundled scripts and styles - Injects a `<meta http-equiv="content-security-policy">` in each page's `<head>` - Supports `script-src` and `style-src` directives by default **Limitations:** - Not supported in `dev` mode — test with `build` + `preview` - External scripts and styles require manual hash configuration - Incompatible with `<ClientRouter />` view transitions (use native View Transition API) - Shiki syntax highlighter (inline styles) not currently supported --- ## Reference Guide ### Concepts | Topic | Reference | When to Consult | |-------|-----...

Details

Author
fusengine
Repository
fusengine/agents
Created
6 months ago
Last Updated
2 days ago
Language
TypeScript
License
MIT

Similar Skills

Semantically similar based on skill content — not just same category

Web & Frontend Listed

astro-security

This skill should be used when implementing Astro security, configuring Content Security Policy in Astro, preventing XSS in Astro, using set:html safely, handling secrets in Astro, configuring astro:env, Astro authentication patterns, Astro Session API, CSRF protection in Astro, configuring security.checkOrigin, Astro cookie security, middleware security patterns, Astro CORS configuration, protecting API endpoints, security.allowedDomains, environment variable security in Astro, import.meta.env secret leakage

5 Updated 1 weeks ago
RadOrigin-LLC
Web & Frontend Solid

astro-7

Expert Astro 7 framework (stable, 7.0.9) — routing, output modes, middleware, Vite Environment API, single Rust compiler, Content Security Policy, Live Collections, Fonts API. Use when building Astro sites, configuring output, or upgrading from Astro 5/6.

22 Updated 2 days ago
fusengine
DevOps & Infrastructure Solid

astro-deployment

Deploying Astro 7 apps — @astrojs/cloudflare (Workers, D1, KV, R2), @astrojs/vercel (Serverless/Edge, Image CDN), @astrojs/netlify (Edge Functions), @astrojs/node (standalone), ISR patterns, edge middleware, skew protection. Use for any deployment configuration.

22 Updated 2 days ago
fusengine