Security Posture Analyzer Skill

Purpose

Analyze the organization's security posture by examining security headers, Content Security Policy, HSTS configuration, security.txt file, and other security indicators.

Input

Raw signals from Phase 2:

• http_signals

• Security headers, CSP, HSTS

• dns_signals

• DMARC, SPF, DKIM records

• html_signals

• Meta tags for security policies

• repository_signals

• Security configurations

Security Categories

HTTP Security Headers

Header Purpose Strength Indicator

Strict-Transport-Security HTTPS enforcement max-age value, includeSubDomains

Content-Security-Policy XSS prevention Policy complexity

X-Frame-Options Clickjacking prevention DENY vs SAMEORIGIN

X-Content-Type-Options MIME sniffing prevention nosniff

X-XSS-Protection XSS filter (legacy) 1; mode=block

Referrer-Policy Referrer leakage control strict-origin-when-cross-origin

Permissions-Policy Feature restrictions Comprehensive vs minimal

Cross-Origin-Opener-Policy Cross-origin isolation same-origin

Cross-Origin-Embedder-Policy Embedding restrictions require-corp

Cross-Origin-Resource-Policy Resource sharing control same-origin

Content Security Policy Analysis

Directive Security Implication

default-src 'self' Restrictive baseline

script-src 'unsafe-inline' XSS vulnerability

script-src 'unsafe-eval' Code injection risk

upgrade-insecure-requests Mixed content handling

report-uri / report-to Active monitoring

Email Security (DNS)

Record Purpose

SPF (TXT) Email sender validation

DKIM Email signing

DMARC Email authentication policy

MTA-STS Email transport security

Security Discovery Files

File Purpose

/.well-known/security.txt Security contact info

/security.txt Security contact info

/.well-known/change-password Password change endpoint

/humans.txt Team information

Analysis Logic

def analyze_security_posture(signals): results = { "security_headers": [], "csp_analysis": None, "email_security": [], "security_files": [], "overall_score": 0, "technologies_detected": [] }

# Security Header Analysis
for header in SECURITY_HEADERS:
    if header.name in signals.http_signals.headers:
        value = signals.http_signals.headers[header.name]
        score, analysis = analyze_header(header.name, value)
        results["security_headers"].append({
            "header": header.name,
            "value": value,
            "present": True,
            "score": score,
            "analysis": analysis
        })
        results["overall_score"] += score
    else:
        results["security_headers"].append({
            "header": header.name,
            "present": False,
            "recommendation": header.recommendation
        })

# CSP Deep Analysis
if 'Content-Security-Policy' in signals.http_signals.headers:
    csp = signals.http_signals.headers['Content-Security-Policy']
    results["csp_analysis"] = analyze_csp(csp)

    # Extract third-party domains from CSP
    third_parties = extract_csp_domains(csp)
    for domain in third_parties:
        results["technologies_detected"].append({
            "name": identify_service(domain),
            "source": "CSP allowed domain",
            "domain": domain
        })

# Email Security Analysis
for record_type in ['SPF', 'DMARC', 'DKIM']:
    for txt in signals.dns_signals.txt_records:
        if record_type.lower() in txt.lower() or is_record_type(txt, record_type):
            score, analysis = analyze_email_record(record_type, txt)
            results["email_security"].append({
                "type": record_type,
                "value": txt,
                "score": score,
                "analysis": analysis
            })

# Security File Discovery
security_files = [
    "/.well-known/security.txt",
    "/security.txt"
]
for file_url in security_files:
    # Check if file exists in signals
    if file_exists_in_signals(signals, file_url):
        content = get_file_content(signals, file_url)
        results["security_files"].append({
            "path": file_url,
            "exists": True,
            "content_analysis": analyze_security_txt(content)
        })

return results

CSP Analysis Function

def analyze_csp(csp_value): directives = parse_csp(csp_value)

analysis = {
    "directives_count": len(directives),
    "security_level": "Unknown",
    "issues": [],
    "strengths": [],
    "third_party_domains": []
}

# Check for unsafe directives
if "'unsafe-inline'" in csp_value:
    analysis["issues"].append({
        "severity": "High",
        "issue": "unsafe-inline allows inline scripts",
        "recommendation": "Use nonces or hashes instead"
    })

if "'unsafe-eval'" in csp_value:
    analysis["issues"].append({
        "severity": "High",
        "issue": "unsafe-eval allows dynamic code execution",
        "recommendation": "Refactor to avoid eval()"
    })

# Check for good practices
if "upgrade-insecure-requests" in csp_value:
    analysis["strengths"].append("Upgrades HTTP to HTTPS")

if "report-uri" in csp_value or "report-to" in csp_value:
    analysis["strengths"].append("CSP violation reporting enabled")

if "default-src 'self'" in csp_value:
    analysis["strengths"].append("Restrictive default policy")

# Extract allowed domains
domains = re.findall(r'https?://([^\s;\'\"]+)', csp_value)
analysis["third_party_domains"] = list(set(domains))

# Calculate security level
if len(analysis["issues"]) == 0 and len(analysis["strengths"]) >= 3:
    analysis["security_level"] = "Strong"
elif len(analysis["issues"]) <= 1:
    analysis["security_level"] = "Moderate"
else:
    analysis["security_level"] = "Weak"

return analysis

Output

{ "skill": "security_posture_analyzer", "results": { "security_headers": [ { "header": "Strict-Transport-Security", "value": "max-age=31536000; includeSubDomains; preload", "present": true, "score": 10, "analysis": { "max_age": 31536000, "include_subdomains": true, "preload": true, "assessment": "Strong - HSTS preload eligible" } }, { "header": "Content-Security-Policy", "value": "default-src 'self'; script-src 'self' https://cdn.example.com; ...", "present": true, "score": 8, "analysis": "See csp_analysis" }, { "header": "X-Frame-Options", "present": false, "recommendation": "Add 'X-Frame-Options: DENY' to prevent clickjacking" } ], "csp_analysis": { "directives_count": 8, "security_level": "Moderate", "issues": [ { "severity": "Medium", "issue": "Script sources include external CDN", "domain": "cdn.example.com" } ], "strengths": [ "Restrictive default policy", "CSP violation reporting enabled" ], "third_party_domains": [ "cdn.example.com", "analytics.example.com", "api.stripe.com" ] }, "email_security": [ { "type": "SPF", "value": "v=spf1 include:_spf.google.com ~all", "score": 7, "analysis": "Good - SPF configured with softfail" }, { "type": "DMARC", "value": "v=DMARC1; p=reject; rua=mailto:dmarc@example.com", "score": 10, "analysis": "Strong - DMARC reject policy with reporting" } ], "security_files": [ { "path": "/.well-known/security.txt", "exists": true, "content_analysis": { "contact": "security@example.com", "encryption_key": true, "bug_bounty": "https://example.com/bug-bounty", "expires": "2025-12-31" } } ], "overall_score": { "score": 72, "max_score": 100, "grade": "B", "assessment": "Good security posture with some improvements needed" }, "technologies_detected": [ { "name": "Google Workspace", "source": "SPF include", "confidence": 90 }, { "name": "Stripe", "source": "CSP allowed domain: api.stripe.com", "confidence": 95 } ], "recommendations": [ { "priority": "High", "item": "Add X-Frame-Options header", "current": "Missing", "recommended": "DENY" }, { "priority": "Medium", "item": "Enable HSTS preload", "current": "Not preloaded", "recommended": "Submit to HSTS preload list" } ] } }

Third-Party Detection from Security Headers

CSP Domain Pattern Service

*.stripe.com Stripe Payments

*.google-analytics.com Google Analytics

*.googletagmanager.com Google Tag Manager

*.facebook.com Facebook SDK

*.intercom.io Intercom

*.zendesk.com Zendesk

*.sentry.io Sentry Error Tracking

.datadog.com Datadog

*.newrelic.com New Relic

Error Handling

• Missing headers: Note as finding, provide recommendations

• Malformed CSP: Parse what's possible, flag errors

• DNS lookup failures: Continue with HTTP-based analysis