CSP Policy Tightener

What this skill does

Reads the current Content-Security-Policy of a site, harvests actual loaded resources from a fresh browser run, and proposes a tightened CSP that drops wildcards in favor of explicit hosts. Output includes the new header and a regression-risk note.

Inputs

• current_csp: the existing Content-Security-Policy header value.
• urls: a list of URLs to crawl when gathering observed resources.
• Optional mode: enforce (default) or report-only.

Steps

1. Parse the current CSP into a directive map: {default-src: [...], script-src: [...], img-src: [...]}.
2. Run a headless browser crawl against each URL using Playwright: npx playwright open --browser chromium <url> programmatically. Record every resource request via page.on('request', ...).
3. Aggregate observed hosts per resource type: scripts -> hosts; images -> hosts; fonts -> hosts; XHR/fetch -> hosts; iframes -> hosts; media -> hosts; styles -> hosts.
4. For each directive in the current CSP, replace wildcards with the observed-host union for that type. Keep 'self' and https: only if observed mixed-content situations require them.
5. Detect inline scripts/styles: if 'unsafe-inline' is currently in script-src or style-src, propose using 'strict-dynamic' with a server-rendered nonce or a hash-set of the inline blocks.
6. Detect eval() use (warning in browser console); if absent, drop 'unsafe-eval'.
7. Run the proposed CSP through the Google CSP Evaluator API and fetch its score. If the score is "Strong (3)" or higher, accept; else, iterate.
8. Output the new header and a Report-URI directive pointing at a logging endpoint for staged rollout.
9. Save the proposed CSP to csp-tightened.txt and the analysis to csp-tightening.md.

Output

csp-tightened.txt (new header, ready to paste) and csp-tightening.md (delta from current, observed hosts per directive, Google evaluator score, rollout plan). Stdout prints the wildcard count removed.

Verification

Stage the new CSP in report-only mode for at least 7 days while collecting violation reports. If reports are empty, switch to enforce mode. Re-run the browser crawl after deploy and confirm zero unexpected blocked resources in the console. Validate header syntax with https://csp-evaluator.withgoogle.com/.

Edge cases

• Sites using third-party tag managers (GTM): explicitly include the tag-manager origin and any observed loaders; tag managers tend to fan out to many hosts.
• Single-page apps with code-splitting: all chunks served from the same origin, so this is usually simpler than expected; verify chunk fingerprints don't escape origin.
• Sites that fetch from user-supplied URLs (user-content domains): keep a controlled allowlist; do not include arbitrary user CDN domains.
• Dynamic feature flags that load new third-party SDKs at runtime: pre-register all possible hosts in the CSP rather than hot-add later.