Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/fusengine/agents/astro-securitynpx skills add fusengine/agents --skill astro-securitygit clone --depth 1 https://github.com/fusengine/agentsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00033 | $0.00990 |
| Opus 5 | $0.00016 | $0.00495 |
| Sonnet 5 | $0.00007 | $0.00198 |
| Haiku 4.5 | $0.00003 | $0.00099 |
Grade A, and why
astro-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 94 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Also covers experimentalStaticHeaders for emitting CSP as adapter-based HTTP headers instead of a meta tag. States the known limitations: CSP is inactive in dev mode (test with build + preview), incompatible with <ClientRouter /> view transitions, and unsupported for Shiki's inline styles. Does not cover general deployment adapter setup beyond the CSP header wiring (astro-deployment).
Astro Security
Agent Workflow (MANDATORY)
Before ANY implementation, use TeamCreate to spawn 3 agents:
- fuse-ai-pilot:explore-codebase - Analyze existing security config, adapters, headers
- fuse-ai-pilot:research-expert - Verify latest Astro 7 CSP docs via Context7/Exa
- mcp__context7__query-docs - Check CSP compatibility with deployment adapter
After implementation, run fuse-ai-pilot:sniper for validation.
Overview
When to Use
- Enabling CSP in an Astro project (stable in v6.0.0)
- Configuring
security.cspinastro.config.mjs - Adding SHA-256/384/512 hashes for external scripts or styles
- Using nonces for dynamic script injection
- Setting up
experimentalStaticHeadersfor adapter-based CSP headers
CSP in Astro
Astro 6 ships Content Security Policy as a stable feature (previously experimental). When enabled:
- Astro automatically generates SHA hashes for all bundled scripts and styles
- Injects a
<meta http-equiv="content-security-policy">in each page's<head> - Supports
script-srcandstyle-srcdirectives by default
Limitations:
- Not supported in
devmode — test withbuild+preview - External scripts and styles require manual hash configuration
- Incompatible with
<ClientRouter />view transitions (use native View Transition API) - Shiki syntax highlighter (inline styles) not currently supported
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 94 lines · 33 tokens per session scan A 630f5802bb33
astro-security is a skill published in the GitHub repository fusengine/agents (25 stars, last pushed 29d ago), licensed MIT. It adds 33 tokens to every session and 990 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
bootstrap-repo-analysis
First-time analysis of a repository with no prior reviewer outcomes. Crawl historical merged-PR review feedback with the gh CLI (plus any preloaded samples), extract the team's review norms, and synthesize the initial per-repo review-style prompt. Use this for a cold-start repo; use continual-learning instead once the…
competitor-ad-intelligence
Scrape competitor ads from Meta, TikTok, Google, and LinkedIn ad libraries, analyze creative patterns (hooks, formats, CTAs), reverse-engineer landing page funnels, and produce a strategic teardown with vulnerability analysis and counter-play recommendations. Use when you need to understand the competitive ad…
render-chatgpt-chat
Assemble a ChatGPT chat-reveal video ad from a thread + timeline JSON — one continuous Playwright recording of a ChatGPT mobile chat (user types with the iOS keyboard up → taps send → keyboard slides down + header cluster swaps in one beat → one gray loading dot → the assistant answer streams in word-by-word)…
meta-ad-scraper
Scrape competitor ads from Meta's Ad Library (Facebook, Instagram, Messenger, Threads, WhatsApp). Search by company name, Facebook Page URL, or keyword. Returns ad creatives, spend estimates, reach, impressions, and campaign details. Use for competitive ad research, messaging analysis, and creative inspiration.
render-imessage-chat
Assemble an iMessage chat-reveal video ad from a thread JSON — one continuous Playwright recording of the conversation animating in (typing dots, composer typing, bubble pops, auto-scroll) crossfaded into a designed end card, with iMessage send/receive SFX and an optional ducked music bed. FREE assembly (Playwright +…
google-ad-scraper
Scrape competitor ads from Google Ads by domain. Returns ad creatives, formats, and campaign details. Use for competitive ad research and messaging analysis.