Generate CSP

security.generate_csp

ProductionBounded custom (Class B)Deterministicstrictinstantv1.0.0

No network

Overview

You pass a map of CSP directives and source expressions; we serialize a Content-Security-Policy (or Content-Security-Policy-Report-Only) header deterministically — quoting keywords, rejecting CR/LF injection, sorting directives when requested, and flagging risky sources. Do not use this to validate an existing header string (use security.validate_csp) or to prove runtime browser enforcement.

CSP headers are easy to misconfigure via string concatenation — structured generation is safer and repeatable.

Reliability

STRICT and deterministic — the same directives and options always give you the same header, byte for byte, while sortDirectives stays true. Warnings are token-level heuristics, and a header we happily serialize can still be a weak policy: what a browser actually enforces is beyond what we can see here. Input validation (not retryable): no directives at all; a directive name that is not lowercase letters, digits and hyphens; a source list that is not an array of strings, or contains null; a CR, LF or other control character anywhere in a name or source; an unquoted keyword while strict is true; an empty source array for a directive that needs one.

Context footprint

Single call replaces fragile manual CSP string assembly. A successful call costs 1 execution credit.

When to use it

When you emit a CSP header from structured configuration.

When validating an existing header string — use security.validate_csp.

Scope

Note

Serializes a structured CSP directive model into a safe, deterministic header value.

Non-goals

Does not fetch resources
Does not evaluate runtime policy effects
A syntactically valid CSP is not proof of protection — actual enforcement depends on browser support and behavior, which this skill does not model

Properties

IdempotentRetry safeStreaming supportedFile input supportedRequires external service

Capabilities

formattinggeneration

Cost & billing

Flat rate per invocation

MetercallsBillable onsuccessCost per call1 credit

File handling

Accepts file_refProduces file_refMax input64 KB

How we handle your data

Sensitive output possible

What this means

This skill may receive sensitive content and may return submitted, transformed, extracted, or reformatted content.

Squillify guarantees

Runs inside Squillify
This skill runs inside Squillify.
Payloads are not sent to an external service by this skill.
Squillify does not permanently store submitted payloads.
Telemetry records metadata only, not submitted content.
Submitted payloads are not used for training.
Submitted payloads are not reviewed by humans.
This skill does not target sensitive data.
The response may contain submitted or transformed content.

Your responsibility

Squillify does not determine whether submitted content is sensitive. Your application is responsible for deciding what data it is allowed to submit. Your application is responsible for securing the response.

Read the Microskill Data Handling Policy

Input schema

Field	Type	Required	Description
directives	object	Yes	Purpose-bound map from lowercase CSP directive names to bounded source lists.
mode	string	No	Header mode; omit it for enforce.
sortDirectives	boolean	No	Whether directives sort deterministically; omit it for true.
strict	boolean	No	Whether unquoted keywords are rejected; omit it for true.
includeRiskWarnings	boolean	No	Whether risk warnings are returned; omit it for true.

Output schema

Field	Type	Required	Description
headerName	string	Yes	HTTP response-header name.
headerValue	string	Yes	Serialized bounded CSP policy.
warnings	array	Yes	From 0 through 1,001 CSP generation warnings, each naming the affected directive, code, and message.

API contract

POST /v1/execute

curl

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"security.generate_csp","input":{"directives":{"default-src":["'self'"]}}}'

Integrations

TypeScript SDK

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("security.generate_csp", {"directives":{"default-src":["'self'"]}});

Errors

Code	HTTP	Retryable	Description
VALIDATION_ERROR	400	No	The request payload failed schema validation.
UNAUTHORIZED	401	No	Missing or invalid API key.
SKILL_NOT_ACCESSIBLE	403	No	The API key is not granted access to this skill.
SKILL_NOT_AVAILABLE_FOR_PLAN	403	No	This skill is not included in your current plan.
PLAN_ELIGIBILITY_UNAVAILABLE	503	Yes	Plan eligibility could not be decided. Retry after backoff.
SKILL_NOT_FOUND	404	No	The requested skill or version does not exist.
TENANT_RATE_LIMITED	429	Yes	Request rate limit exceeded. Retry after backoff.
QUOTA_EXCEEDED	429	Yes	Plan quota exhausted. Retryable once the quota period resets.
EXECUTION_TIMEOUT	504	Yes	Execution exceeded the allowed time budget.

Other limits

Limit	Value
Recommended inline bytes	32 KiB

Limitations

Does not fetch resources
Does not evaluate runtime policy effects
A syntactically valid CSP is not proof of protection — actual enforcement depends on browser support and behavior, which this skill does not model
Validating an existing header string (use security.validate_csp)

How to call

POST /v1/execute (requires authentication)

Request bodyjson

{
  "skillKey": "security.generate_csp",
  "input": {
    "directives": {
      "default-src": [
        "'self'"
      ]
    }
  }
}

Examples

Minimal default-src policy

Inputjson

{
  "directives": {
    "default-src": [
      "'self'"
    ]
  }
}

Expected outputjson

{
  "warnings": [],
  "headerName": "Content-Security-Policy",
  "headerValue": "default-src 'self'"
}

Risky script-src without default-src fallback