Skills for Real Engineers. Straight from my .agents directory.
39 skills
csp-bypass-advanced
Agent skill from
Advanced Content Security Policy bypass techniques. Use when XSS or data exfiltration is blocked by CSP and you need to find policy weaknesses, trusted endpoint abuse, nonce leakage, or exfiltration channels that CSP cannot block.
How to install csp-bypass-advanced
install csp-bypass-advanced
# install the hack-skills pack with the skills CLI
npx skills add yaklang/hack-skills# or add only this skill to Claude Code: copy the folder
skills/csp-bypass-advanced/
# into
~/.claude/skills/csp-bypass-advanced/ (all projects)
.claude/skills/csp-bypass-advanced/ (one project)
1# SKILL: CSP Bypass — Advanced Techniques23> **AI LOAD INSTRUCTION**: Covers per-directive bypass techniques, nonce/hash abuse, trusted CDN exploitation, data exfiltration despite CSP, and framework-specific bypasses. Base models often suggest `unsafe-inline` bypass without checking if the CSP actually uses it, or miss the critical `base-uri` and `object-src` gaps.45## 0. RELATED ROUTING67- [xss-cross-site-scripting](../xss-cross-site-scripting/SKILL.md) for XSS vectors to deliver after CSP bypass8- [dangling-markup-injection](../dangling-markup-injection/SKILL.md) when CSP blocks scripts but HTML injection exists — exfiltrate without JS9- [crlf-injection](../crlf-injection/SKILL.md) when CRLF can inject CSP header or steal nonce via response splitting10- [waf-bypass-techniques](../waf-bypass-techniques/SKILL.md) when both WAF and CSP must be bypassed11- [clickjacking](../clickjacking/SKILL.md) when CSP lacks `frame-ancestors` — clickjacking still possible1213---1415## 1. CSP DIRECTIVE REFERENCE MATRIX1617| Directive | Controls | Default Fallback |18|---|---|---|19| `default-src` | Fallback for all `-src` directives not explicitly set | None (browser default: allow all) |20| `script-src` | JavaScript execution | `default-src` |21| `style-src` | CSS loading | `default-src` |22| `img-src` | Image loading | `default-src` |23| `connect-src` | XHR, fetch, WebSocket, EventSource | `default-src` |24| `frame-src` | iframe/frame sources | `default-src` |25…
Excerpt shown under the repository's MIT license.
More skills in hack-skills
Keep exploring
Similar skill repositories
Public repository for Agent Skills
20 skills
Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.
CCCU6 skills
An AI skill that provides design intelligence for building professional UI/UX across multiple platforms.
CCCXCUGH6 skills
Persistent Context Across Sessions for Every Agent – Captures everything your agent does during sessions, compresses it with AI, and injects relevant context back into future sessions. Works with Claude Code, OpenClaw, Codex, Gemini, Hermes, Copilot, OpenCode + More
CCCXGHGM+135 skills
Production-grade engineering skills for AI coding agents.
CCCXCU25 skills