$ loading_
检查并配置 Power Pages 站点安全响应头，定位风险并指导修复设置。
复制安装指令，让 AI 自动完成配置 · 推荐新手
请帮我安装 askskill 上的 "manage-headers" 技能： 1. 下载 https://raw.githubusercontent.com/microsoft/power-platform-skills/main/plugins/power-pages/skills/manage-headers/SKILL.md 2. 保存为 ~/.claude/skills/manage-headers/SKILL.md 3. 装好后重载技能，告诉我可以用了
请帮我检查 Power Pages 站点的 Content Security Policy 配置。当前浏览器控制台提示某些脚本和图片被拦截，请找出缺失或过严的策略，并给出可执行的修复步骤。
指出 CSP 配置问题、受影响资源、推荐策略调整方案及具体修复步骤。
我想把 Power Pages 页面嵌入到另一个站点中，请检查当前的 frame 相关安全头和点击劫持防护设置，说明为什么无法嵌入，并告诉我如何安全地允许特定来源嵌入。
说明阻止嵌入的头部配置，给出安全放行特定来源的建议与设置步骤。
请审查我的 Power Pages 站点的 CORS 和 Cookie 安全设置。我需要允许指定前端域名跨域访问部分资源，同时确保 Cookie 的 SameSite、Secure 等设置足够安全。
给出跨域访问风险评估、允许清单建议，以及 Cookie 安全加固方案。
Plugin check: Run
node "${CLAUDE_PLUGIN_ROOT}/scripts/check-version.js"— if it outputs a message, show it to the user before proceeding.
Inspect and configure the HTTP security headers for a Power Pages site. Headers are configured as HTTP/* site settings stored in .powerpages-site/site-settings/ YAML files.
Initial request: $ARGUMENTS
.yml file in .powerpages-site/site-settings/. The file name uses - instead of / (e.g., HTTP/X-Frame-Options → http-x-frame-options.sitesetting.yml).HTTP/Strict-Transport-Security — the runtime does not recognize it and the setting has no effect.HTTP/* header emission. Verify headers in an incognito tab, not the studio preview.script-src contains 'nonce', the runtime replaces it per-request with 'nonce-<random>' and auto-hashes inline event handlers. Scripts created dynamically via document.createElement do NOT receive the nonce.SameSite=None requires HTTPS. The runtime sets Secure on every cookie over HTTPS automatically.* is auto-specialized. The runtime replaces * per-request with the specific requesting Origin — the browser sees a single-origin header, not a wildcard.Create tasks in four groups. Mark each in_progress when starting, completed when done.
| Group | When to create | Tasks |
|---|---|---|
| 1 | At start | Check prerequisites |
| 2 | After prerequisites pass | Inspect current headers · Assess and plan (skip "Assess and plan" in review mode) |
| 3 | After user approves changes | Apply changes (skip in review mode OR if no changes were accepted) |
| 4 | After apply or assess | Summarize (always) |
Use Glob to find **/powerpages.config.json. If $ARGUMENTS contains --review <out-dir>, remember the output directory — Steps 3–4 are skipped and Step 5 writes JSON only.
Check that .powerpages-site/site-settings/ exists. If not, the site has not been deployed yet — tell the user and recommend /deploy-site. Stop.
Use Glob to find all *.yml files in .powerpages-site/site-settings/. Use Read to read each file and extract the name and value fields. Identify all settings with an HTTP/ prefix — these are the configured headers.
Compare against the recognized header catalogue in references/headers-reference.md. For each header in the catalogue:
…
为 Power Apps 代码应用接入 Azure DevOps 连接器，便于查询工单、提报缺陷与管理流水线。
为 Power Pages 代码站点补齐 SEO 基础配置，提升搜索可见性与分享展示效果。