Analyze Content-Security-Policy headers and bypass them to achieve cross-site scripting by exploiting unsafe-inline/unsafe-eval, whitelisted JSONP endpoints, base-uri and form-action gaps, and nonce/hash weaknesses, then exfiltrate data even without script-src control.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-content-security-policy-bypassnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-content-security-policy-bypass -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-content-security-policy-bypass -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/performing-content-security-policy-bypassgh skill install mukul975/Anthropic-Cybersecurity-Skills performing-content-security-policy-bypassgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/performing-content-security-policy-bypass ~/.claude/skills/performing-content-security-policy-bypass # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/performing-content-security-policy-bypass ~/.agents/skills/performing-content-security-policy-bypass # Codex, Cursor, Gemini CLI, Copilot, OpenCode