← All skills
Skill
content-security-policy
skill:thedaviddias/front-end-checklist#content-security-policy
Use when reviewing headers, forms, cookies, or third-party integrations related to Implement a content security policy. Validate the effective browser and HTTP behavior in a production-like environment.
Verdict
Inconclusive
The analysis could not cover enough of the artifact to decide.
0
findings
—
highest severity
0
threat classes
1,978
files scanned
95/95
checks satisfied
0
package advisories
Why this verdict
- inconclusive: unresolved question on EXEC
Security findings 0
No individual findings recorded
The inconclusive verdict rests on the open questions and coverage gaps below.
Open questions 1
What the analysis could not settle from the code alone.
Residue R1 (exec 'unsafe-eval' at rule.md line 332) is adjudicated as a false lead rather than a capability: the flagged line is a row in the 'Common CSP Mistakes' table advising to avoid unsafe-eval ('Avoid eval(), new Function()'), which the declared CSP-guidance purpose plainly covers; no execution instruction exists in the shown content.
Code execution
Coverage gaps 4
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scannedapps/web/public/projects/indie-dev-toolkit/indie-dev-toolkit.mp4
context:unanalyzable_binary binary content is only byte-scanneddocs/audits/2026-10-04-mcp-validation/assets/checklist-interaction.webm
context:unanalyzable_binary binary content is only byte-scanneddocs/audits/2026-10-04-mcp-validation/assets/mcp-tab-interaction.webm
context:manifest_unparseable yaml: YAML node count exceeds 20000pnpm-lock.yaml