config-headers-tls

92 / 100 · Low risk

Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By zaurqasimov1337/MilliSec-Pentest-AI (GitHub) · security · 18 stars · scanned at commit 42679ad

Security misconfiguration checks — CORS, HTTP security headers, TLS/SSL, cookie flags, and information disclosure (verbose errors, exposed .git/.env/backups, directory listing, debug/actuator endpoints). Use as a baseline pass on every web target. OWASP A05/A02/A01, WSTG-CONF, CWE-16/942/693/200/319.

Works with any agent that supports SKILL.md skills.

What this skill can do

Sends data to these websites: evil.example

The author does not mention this. Expected for a security skill.

Found in 3 places.

.claude/skills/config-headers-tls/SKILL.md, line 12curl -s -I "$U/api/data" -H "Origin: https://evil.example"
.claude/skills/config-headers-tls/SKILL.md, line 26curl -sI "$U" | grep -iE "content-security|strict-transport|x-content-type|x-frame|referrer|permissions-policy"
.claude/skills/config-headers-tls/SKILL.md, line 44code=$(curl -s -o /dev/null -w "%{http_code}" "$U/$p"); echo "$code /$p"; done

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.

Found in 6 places.

.claude/skills/config-headers-tls/SKILL.md, line 12curl -s -I "$U/api/data" -H "Origin: https://evil.example"
.claude/skills/config-headers-tls/SKILL.md, line 18dr corsy -u "$U"
.claude/skills/config-headers-tls/SKILL.md, line 26curl -sI "$U" | grep -iE "content-security|strict-transport|x-content-type|x-frame|referrer|permissions-policy"

Show 3 more

.claude/skills/config-headers-tls/SKILL.md, line 31dr testssl.sh --severity LOW --quiet $H
.claude/skills/config-headers-tls/SKILL.md, line 42for p in .git/HEAD .env .git/config backup.zip .DS_Store server-status actuator/health \
.claude/skills/config-headers-tls/SKILL.md, line 50dr nuclei -u "$U" -jsonl -silent -tags exposure,misconfig,config

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'config-headers-tls' ] || [ -L ~/.agents/skills/'config-headers-tls' ]; then echo 'A skill folder named config-headers-tls already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/zaurqasimov1337/MilliSec-Pentest-AI' "$d" && git -C "$d" checkout --quiet '42679ad1a7e37f987629977c96ab0f985491f31e' -- '.claude/skills/config-headers-tls' && mkdir -p ~/.agents/skills && cp -R "$d"/'.claude/skills/config-headers-tls' ~/.agents/skills/'config-headers-tls' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'config-headers-tls' ~/.claude/skills/'config-headers-tls' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for zaurqasimov1337/MilliSec-Pentest-AI shows the score of its lowest-scoring skill.

SkillTrust badge for zaurqasimov1337/MilliSec-Pentest-AI

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/zaurqasimov1337/MilliSec-Pentest-AI.svg)](https://zalavijaysinh.github.io/skilltrust/repos/zaurqasimov1337/MilliSec-Pentest-AI/)

Score history

Date	Version	Score
2026-11-07	`42679ad`	92