Skill

performing-security-headers-audit

skill:mukul975/anthropic-cybersecurity-skills#performing-security-headers-audit

Auditing HTTP security headers including CSP, HSTS, X-Frame-Options, and cookie attributes to identify missing or misconfigured browser-level protections.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 21:42 UTC at 54a7988

findings

high

highest severity

threat classes

4,532

files scanned

73/73

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/performing-security-headers-audit:skills/performing-security-headers-audit/SKILL.md:242:EXFIL

Security findings 1

Data exfiltration

highContextual risklow confidence

The skill instructs the agent to submit the audit target's hostname to third-party online scanning services (SecurityHeaders.com and Mozilla Observatory), sending the audited host's identity off-host to external parties during the audit workflow.

skills/performing-security-headers-audit/SKILL.md:242-243

echo

vector:instruction

Counter-argument considered

Strongest case against: the lines are only echo statements printing report text and header auditing is the declared core capability; but the comment directs the agent to actually use these online tools, the URLs embed the audited hostname as the query parameter of third-party services, no declared claim covers third-party submission (the request shows declared claims: None), and no carve-out or mitigation applies. The claim accurately describes an undeclared, low-severity contextual disclosure channel, so it stands.