Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sawrus/agent-guides --skill security-headersgit clone --depth 1 https://github.com/sawrus/agent-guidesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sawrus/agent-guides/security-headers)<a href="https://agentmods.dev/skills/sawrus/agent-guides/security-headers"><img src="https://agentmods.dev/badge/skills/sawrus/agent-guides/security-headers/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sawrus/agent-guides/security-headers"><img src="https://agentmods.dev/badge/skills/sawrus/agent-guides/security-headers.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00260 |
| Opus 5 | $0.00000 | $0.00130 |
| Sonnet 5 | $0.00000 | $0.00052 |
| Haiku 4.5 | $0.00000 | $0.00026 |
Grade A, and why
security-headers scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Skill: HTTP Security Headers
When to load
When configuring web servers, API gateways, or reviewing HTTP responses.
Required Headers
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Content-Security-Policy "
default-src 'self';
script-src 'self' 'nonce-{NONCE}';
style-src 'self' 'unsafe-inline';
img-src 'self' data: https://cdn.mycompany.com;
connect-src 'self' https://api.mycompany.com;
frame-ancestors 'none';
" always;
API-Specific
- Remove:
X-Powered-By,Server(information disclosure) - Add:
X-Request-ID(tracing),Cache-Control: no-store(auth responses) - CORS: Never
Access-Control-Allow-Origin: *for credentialed requests
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 30 lines · 0 tokens per session scan A e4101d3728aa
security-headers is a skill published in the GitHub repository sawrus/agent-guides (17 stars, last pushed 10d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 260 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
architecture-decision-records
Comprehensive patterns for creating, maintaining, and managing Architecture Decision Records (ADRs) that capture the context and rationale behind significant technical decisions.
agent-orchestration-improve-agent
Systematic improvement of existing agents through performance analysis, prompt engineering, and continuous iteration.
agentmail
Email infrastructure for AI agents. Create accounts, send/receive emails, manage webhooks, and check karma balance via the AgentMail API.
aws-cdk-development
AWS Cloud Development Kit (CDK) expert for building cloud infrastructure with TypeScript/Python.
aws-cost-cleanup
Automated cleanup of unused AWS resources to reduce costs.
azd-deployment
Deploy containerized frontend + backend applications to Azure Container Apps with remote builds, managed identity, and idempotent infrastructure.