Headers

核心功能：检查9类分高/中/低优先级的HTTP安全头，按A-F评级网站HTTP安全态势，检测Server等泄露技术栈的信息。典型场景：网站安全检查、安全头审计、排查缺失安全头。支持输入单/多个域名，输出文本或JSON格式，无依赖。

rogue-agent1

热度 52.93

最近更新 2026-05-11 17:37:27

分类：安全依赖：代码执行应用场景：报告撰写

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add headers

Metadata

name: security-headers
description: Audit HTTP security headers for any website — checks HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, and XSS-Protection. Grades sites A-F. Detects server info leakage (Server, X-Powered-By). Use when asked to check website security, audit headers, find missing security headers, or grade a site's HTTP security posture. Zero dependencies.

security-headers 🔒

HTTP security headers auditor with grading and info leak detection.

Commands

# Check one or more sites (auto-adds https://)
python3 scripts/headers.py github.com example.com

# JSON output
python3 scripts/headers.py --json example.com

Checks (9 headers)

🔴 High: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP)
🟡 Medium: X-Content-Type-Options, X-Frame-Options, Referrer-Policy
🟢 Low: Permissions-Policy, X-XSS-Protection, COOP, CORP

Grading

A (≥78%): 7+ headers present
B (≥56%): 5-6 headers
C (≥33%): 3-4 headers
D (≥11%): 1-2 headers
F (0%): No security headers

Info Leak Detection

Flags Server, X-Powered-By, X-AspNet-Version, X-Generator headers that reveal technology stack.