Set a Permissions-Policy header
SkillSecuritypermissions-policy is a skill that guides an AI agent through reviewing HTTP response headers for defense-in-depth security hardening on any web application. It helps the person running the agent check that headers are configured correctly and spot gaps in hardening.
Available today. Use it from your connected AI after setup.
No other account needed.
Have an AI agent that can load skills.
Then ask your AI: use the Set a Permissions-Policy header skill
What your AI can do with it
- Reviews HTTP response headers on any web application
- Checks headers for defense-in-depth security hardening
- Guides the agent through a header review process
- Identifies gaps in security header configuration
Getting started
- Have an AI agent that can load skills.
- Add the permissions-policy skill to the agent's available skills.
- Ask the agent to review the HTTP response headers of the web application for security hardening.
What this skill tells your AI
The instructions your AI receives, as published by thedaviddias/front-end-checklist in skills/permissions-policy/SKILL.md and read by ahel’s review.
A site compromised by XSS that has unrestricted camera and microphone access can silently record the user. Permissions-Policy limits which browser APIs are available, reducing attacker capabilities even after a successful injection.
Quick Reference
- Use
Permissions-Policyto disable browser features your site does not use (camera, microphone, geolocation, payment) - Syntax:
Permissions-Policy: camera=(), microphone=(), geolocation=()— empty()means denied to all - Previously called
Feature-Policy— the old syntax is deprecated and only supported in older browsers - Restricting unused features limits the blast radius if your site is compromised by XSS
- Third-party iframes inherit page restrictions unless you explicitly grant them permissions
Check
Check whether the server sends a Permissions-Policy header and review which browser features are allowed or denied. Identify any powerful features (camera, microphone, geolocation, payment, USB) that are enabled but not required by the application.
Fix
Add a Permissions-Policy header that disables all browser features your site does not use. Start with camera=(), microphone=(), geolocation=() and expand the list based on what the application actually needs.
Explain
Explain what the Permissions-Policy header does, how it restricts browser APIs like camera and geolocation, and why disabling unused features improves security.
Code Review
Review server config, headers, forms, and integration points related to Set a Permissions-Policy header. Flag exact responses, cookies, or browser behaviors that violate the rule, and verify them against the effective production-like response.
For full implementation details, code examples, and framework-specific guidance,
see references/rule.md.
Rule page: https://frontendchecklist.io/en/rules/security/permissions-policy
Signals
- GitHub stars
- 74k
- Forks
- 7k
- Last commit
- Aug 2026
Questions
- When should this skill be used?
- Use it when reviewing HTTP response headers for defense-in-depth security hardening on any web application.
- What does the skill do?
- It guides the agent through checking HTTP response headers for security hardening.
- Does it work on any web application?
- Yes, the skill is described as applying to any web application.
Advanced
- Item type
- skill
- Key
permissions-policy- Source
- github.com/thedaviddias/front-end-checklist