Plan, design, and implement A/B tests and experiments with statistical rigor. Covers hypothesis frameworks, sample sizing, metrics, and result analysis.
中文简介正在准备中。当前显示原文说明。
SebastianLuser/claude-code-arcane32026年10月27日 更新
免费在 GitHub 公开
csp-headers
Configure security headers (CSP, HSTS, Permissions-Policy, COOP/COEP) for Go/TS backends and Cloudflare. Prevents XSS and clickjacking.
中文简介正在准备中。当前显示原文说明。
SebastianLuser/claude-code-arcane星标 3(GitHub 3 + cccskills 0)
集成工具Cloudflare
实测评分 未实测
查看安装方法包含的文件（3）
- SKILL.md2.6 KB
- references/anti-patterns-checklist.md1.1 KB
- references/implementation.md945 B
SKILL.md（原文）
安装前可以查看交给 AI 代理的指令内容。
CSP & Security Headers
Default deny, nonces en CSP, report-only antes de enforce. Stack: Go + TS backends, React+Vite frontends, Cloudflare CDN.
Headers Críticos
| Header | Objetivo | Criticidad |
|---|---|---|
Content-Security-Policy | Prevenir XSS, data exfiltration | ALTA |
Strict-Transport-Security | Forzar HTTPS | ALTA |
X-Content-Type-Options: nosniff | Evitar MIME sniffing | MEDIA |
Referrer-Policy: strict-origin-when-cross-origin | No leak URLs | MEDIA |
Permissions-Policy | Deshabilitar APIs no usadas (cam/mic/geo) | MEDIA |
Cross-Origin-Opener-Policy: same-origin | Aislar browsing context | MEDIA |
X-Frame-Options: DENY | Clickjacking (legacy; CSP frame-ancestors lo supera) | MEDIA |
X-XSS-Protection está deprecado — solo CSP.
CSP Default Educabot
default-src 'self' + script-src 'self' 'nonce-{RANDOM}' 'strict-dynamic' + style-src 'self' 'nonce-{RANDOM}' + img/font/connect whitelists + frame-ancestors 'none' + base-uri 'self' + form-action 'self' + upgrade-insecure-requests + report-uri.
Nonces: 128-bit crypto-random por request. Inyectar en <script nonce> y <style nonce> server-side. NUNCA unsafe-inline junto con nonce.
strict-dynamic: scripts con nonce cargan otros dinámicamente. Reemplaza whitelist de dominios (débil contra JSONP bypass).
Vite SPA (sin SSR): vite-plugin-csp-guard (hashes SHA256 en build time), o proxy que inyecta nonce, o SSR con nonce por request.
Report-Only → Enforce
- Report-only 2-4 semanas:
Content-Security-Policy-Report-Only+ endpoint/csp-report - Analizar: agrupar por blocked-uri/violated-directive → whitelist/remover/mover
- Enforce:
Content-Security-Policy
HSTS
max-age=63072000; includeSubDomains; preload. Empezar con max-age corto (300s), escalar. Preload: difícil salir (meses). Submit en hstspreload.org.
Permissions-Policy
Default: camera=(), microphone=(), geolocation=(), interest-cohort=(). Apps educativas con webcam: camera=(self), microphone=(self).
→ Read references/implementation.md for Go, TS, Cloudflare implementation details, iframe/embedding config, testing tools
→ Read references/anti-patterns-checklist.md for anti-patterns and pre-deployment checklist
评价
还没有评价。欢迎分享你的使用感受。
评论
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
同一仓库的技能
Web/mobile accessibility decision guide: WCAG 2.2 AA, ARIA, keyboard nav, focus management, contrast, testing. Use for: a11y, accessibility, wcag, aria, screen reader, keyboard, contrast.
中文简介正在准备中。当前显示原文说明。
SebastianLuser/claude-code-arcane32026年10月27日 更新
Generate, iterate, and scale ad creative for paid advertising across Google, Meta, LinkedIn, and X. Covers platform specs, creative frameworks, and quality validation.
中文简介正在准备中。当前显示原文说明。
SebastianLuser/claude-code-arcane32026年10月27日 更新
Musica interactiva para juegos: layering vertical, re-secuenciacion horizontal, stingers, reglas de transicion con sync points, y mapeo de estados de gameplay a musica. Usar para: musica adaptativa, sistema de musica dinamica, transiciones musicales, combat music.
中文简介正在准备中。当前显示原文说明。
SebastianLuser/claude-code-arcane32026年10月27日 更新
Design multi-agent systems, create agent architectures, define communication patterns, and build autonomous agent workflows with structured evaluation frameworks.
中文简介正在准备中。当前显示原文说明。
SebastianLuser/claude-code-arcane32026年10月27日 更新
Inter-agent communication protocol for C-suite agent teams. Defines invocation syntax, loop prevention, isolation rules, response formats, and quality loops.
中文简介正在准备中。当前显示原文说明。
SebastianLuser/claude-code-arcane32026年10月27日 更新