HTTP Header Analyzer
by @hostilespider
Analyze HTTP security headers and TLS configuration. Find missing headers, weak ciphers, and misconfigurations in web applications.
clawhub install http-header-analyzerπ About This Skill
name: http-header-analyzer description: Analyze HTTP security headers and TLS configuration. Find missing headers, weak ciphers, and misconfigurations in web applications. metadata: {"openclaw":{"emoji":"π","requires":{"bins":["curl"]}}}
HTTP Header Analyzer
Check HTTP security headers and TLS configuration. Find missing protections and misconfigurations.
Quick Start
# Analyze a single URL
python3 {baseDir}/scripts/analyze-headers.py https://example.comCheck multiple targets
python3 {baseDir}/scripts/analyze-headers.py -f urls.txtJSON output
python3 {baseDir}/scripts/analyze-headers.py https://example.com --json
Headers Checked
| Header | Purpose | Risk if Missing |
|--------|---------|-----------------|
| Strict-Transport-Security | Forces HTTPS | Medium |
| Content-Security-Policy | XSS protection | Medium-High |
| X-Frame-Options | Clickjacking protection | Medium |
| X-Content-Type-Options | MIME sniffing protection | Low |
| X-XSS-Protection | XSS filter (legacy) | Low |
| Referrer-Policy | Controls referrer leakage | Low |
| Permissions-Policy | Feature restrictions | Low |
| Cross-Origin-Opener-Policy | Cross-origin isolation | Low |
| Cross-Origin-Embedder-Policy | Cross-origin isolation | Low |
| Cross-Origin-Resource-Policy | Cross-origin protection | Low |
Options
URL β Target URL(s) to analyze-f FILE β File with URLs (one per line)--json β JSON output--follow β Follow redirects (default: yes)--timeout SECS β Request timeout (default: 10)--user-agent UA β Custom User-Agent--check-tls β Also check TLS certificate info--severity LEVEL β Minimum severity to report: low, medium, highOutput
=== https://example.com ===
β
Strict-Transport-Security: max-age=31536000; includeSubDomains
β
Content-Security-Policy: default-src 'self'
β X-Frame-Options: MISSING (clickjacking risk)
β
X-Content-Type-Options: nosniff
β Referrer-Policy: MISSING
β οΈ Server: nginx/1.18.0 (version exposed)Score: 3/6 security headers present
Risk: MEDIUM
π‘ Examples
# Analyze a single URL
python3 {baseDir}/scripts/analyze-headers.py https://example.comCheck multiple targets
python3 {baseDir}/scripts/analyze-headers.py -f urls.txtJSON output
python3 {baseDir}/scripts/analyze-headers.py https://example.com --json
βοΈ Configuration
URL β Target URL(s) to analyze-f FILE β File with URLs (one per line)--json β JSON output--follow β Follow redirects (default: yes)--timeout SECS β Request timeout (default: 10)--user-agent UA β Custom User-Agent--check-tls β Also check TLS certificate info--severity LEVEL β Minimum severity to report: low, medium, high