Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add pedroiff0/awesome-skills --skill express-csp-runtime-configgit clone --depth 1 https://github.com/pedroiff0/awesome-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pedroiff0/awesome-skills/express-csp-runtime-config)<a href="https://agentmods.dev/skills/pedroiff0/awesome-skills/express-csp-runtime-config"><img src="https://agentmods.dev/badge/skills/pedroiff0/awesome-skills/express-csp-runtime-config/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pedroiff0/awesome-skills/express-csp-runtime-config"><img src="https://agentmods.dev/badge/skills/pedroiff0/awesome-skills/express-csp-runtime-config.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00087 | $0.00799 |
| Opus 5 | $0.00044 | $0.00400 |
| Sonnet 5 | $0.00017 | $0.00160 |
| Haiku 4.5 | $0.00009 | $0.00080 |
Grade A, and why
express-csp-runtime-config scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
The HTML source (curl) shows the script; the live DOM shows undefined. That How it starts
The opening of the file, as written. The whole thing — 70 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Express + strict CSP: injecting runtime config to the client
When this applies
- Express app rendering EJS (or any server template) with helmet CSP.
- scriptSrc includes only 'self' (the template default) — there is NO 'unsafe-inline'. This is the secure default and must NOT be relaxed to "fix" a script.
- You need a value computed server-side (API path prefix, feature flag, locale, CSRF token, demo vs prod marker) available to a .js file served from /js/.
The trap (what happened in a real session)
Injecting the value via an inline script in the EJS head:
<script>window.__API_PREFIX__ = '<%= apiPrefix %>';</script>
looks correct and even appears in the served HTML — but the browser silently drops the inline script because the CSP forbids unsafe-inline. Result: window.API_PREFIX is undefined, the client JS never applies the prefix, and you get cryptic failures elsewhere (e.g. every API call hits the wrong backend → 401 Token invalido, with no console error pointing at the cause). The HTML source (curl) shows the script; the live DOM shows undefined. That gap IS the fingerprint of a CSP-blocked inline script.
The pattern that works
Put the value in a data-* attribute on (or ), and read it from the served JS via getAttribute. No inline script, so CSP is happy.
In the EJS layout (views/partials/header.ejs or equivalent):
<html lang="pt-BR" data-api-prefix="<%= typeof apiPrefix !== 'undefined' ? apiPrefix : '' %>">
In the served JS (public/js/common.js):
async function apiRequest(url, options = {}) {
const prefix = document.documentElement.getAttribute('data-api-prefix') || '';
const finalUrl = url.startsWith('/api/') ? prefix + url : url;
// ... fetch(finalUrl, ...)
}
Diagnosis checklist when "it works via curl but the browser shows undefined"
- curl the page and grep for the injected value — if present in HTML but typeof window.X is undefined in the browser console, the value was in an inline script blocked by CSP.
- Open DevTools → Network/Console: a blocked inline script logs "Refused to execute inline script because it violates CSP" (sometimes only in the browser console, not surfaced as a JS error).
- Fix: move the data to a data-* attribute; read it with getAttribute.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 70 lines · 87 tokens per session scan A 924abe474001
express-csp-runtime-config is a skill published in the GitHub repository pedroiff0/awesome-skills (1 stars, last pushed 3d ago), licensed MIT. It adds 87 tokens to every session and 799 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
svix-sending-webhooks
Everything for working with Svix webhooks: first-time setup (API key, SDK install, first message), Dispatch (sending webhooks to your customers), Ingest (receiving third-party webhooks), Applications, Channels, customer UIDs, idempotency, App Portal embedding, operational webhooks, the Svix CLI, and — only when the…
receiving-webhooks
General guidelines for building a robust webhook receiver/handler: verifying signatures, raw-body access, replay protection, async processing, retries and endpoint auto-disabling. Use whenever you write, review, or debug a handler that consumes incoming webhooks from any provider.
mnemosyne-maintenance
Use when: upgrading Mnemosyne, diagnosing slow/hung consolidation (mnemosynesleep), fixing missing embeddings, or troubleshooting import/version mismatches.
docs-from-code
Generates and updates README.md and API reference docs by reading your codebase's functions, routes, types, schemas, and architecture. Uses graphify to build a knowledge graph first, then writes accurate docs from it. Use when asked to write docs, generate a README, document an API, update stale docs, create an API…
api-to-example
Turns REST API documentation into a runnable curl, fetch, or code example with required headers, request body, and placeholders for secrets. Use when the user wants to generate a request from API docs, an endpoint, or a Swagger/OpenAPI spec — "give me a curl for this", "show a fetch example", "how do I call this API".
content-modelling
Design CMS content models — content types, fields, editorial workflows, governance rules, and COPE (Create Once, Publish Everywhere) patterns — for structured, multi-channel publishing. Use when the user asks to design a content model, define content types in a CMS, structure fields for editorial content, plan a…