$ ~/registry/skill/microsoft-plugins-power-pages-skills-manage-headers

SKILL

manage-headers

Name: manage-headers
Author: microsoft

Review and fix Power Pages security headers, CSP, CORS, cookies, and embedding settings.

Stars

★ 440

Source

GitHub

Updated

2026-07-11

// securityLow risk

Prompt only, no code
Open source
Community-trusted· 440

Running security audit…

Credentials
Network egress
Code execution
Data access
Supply chain

// install

Copy the install command and let the AI configure it · recommended for beginners

Please install the "manage-headers" skill from askskill:
1. Download https://raw.githubusercontent.com/microsoft/power-platform-skills/main/plugins/power-pages/skills/manage-headers/SKILL.md
2. Save it as ~/.claude/skills/manage-headers/SKILL.md
3. Reload skills and tell me it's ready

// download

Download SKILL.mdInstall manifest ↗

// examples

Fix CSP errors

Prompt

Please review the Content Security Policy configuration for my Power Pages site. The browser console shows some scripts and images are being blocked. Identify missing or overly strict directives and provide actionable fix steps.

Expected

An analysis of CSP issues, affected resources, recommended policy changes, and concrete remediation steps.

Allow site embedding

Prompt

I want to embed my Power Pages page into another site. Check the current frame-related security headers and clickjacking protections, explain why embedding fails, and show me how to safely allow embedding from specific origins.

Expected

An explanation of which headers block embedding, plus safe recommendations and setup steps to allow specific origins.

Set up CORS and cookie security

Prompt

Please audit the CORS and cookie security settings for my Power Pages site. I need to allow a specific frontend domain to access some resources cross-origin while keeping SameSite, Secure, and related cookie settings safe.

Expected

A cross-origin risk assessment, allowlist recommendations, and a cookie hardening plan.

// docs

Plugin check: Run node "${CLAUDE_PLUGIN_ROOT}/scripts/check-version.js" — if it outputs a message, show it to the user before proceeding.

Manage Headers

Inspect and configure the HTTP security headers for a Power Pages site. Headers are configured as HTTP/* site settings stored in .powerpages-site/site-settings/ YAML files.

Initial request: $ARGUMENTS

Gotchas

Site settings are YAML files. Each header is a separate .yml file in .powerpages-site/site-settings/. The file name uses - instead of / (e.g., HTTP/X-Frame-Options → http-x-frame-options.sitesetting.yml).
Absent = no header. When a site setting is absent, the runtime omits that header entirely (except CSP on new sites — see headers-reference.md).
HSTS and Cache-Control are platform-managed. Do not try to set HTTP/Strict-Transport-Security — the runtime does not recognize it and the setting has no effect.
Maker-mode bypasses headers. Requests from Power Pages Studio skip all HTTP/* header emission. Verify headers in an incognito tab, not the studio preview.
CSP is pass-through. The runtime emits the value verbatim — it does NOT merge runtime sources automatically. The CSP MUST include Power Pages runtime hosts or the site breaks.
CSP nonce. When script-src contains 'nonce', the runtime replaces it per-request with 'nonce-<random>' and auto-hashes inline event handlers. Scripts created dynamically via document.createElement do NOT receive the nonce.
SameSite=None requires HTTPS. The runtime sets Secure on every cookie over HTTPS automatically.
CORS * is auto-specialized. The runtime replaces * per-request with the specific requesting Origin — the browser sees a single-origin header, not a wildcard.

Workflow

Prerequisites — Locate project, confirm site-settings directory exists
Inspect current headers — Read site-setting YAML files, identify configured and missing headers
Assess and plan — Identify gaps, present recommendations
Apply changes — Edit existing settings or create new ones
Summarize — Present results, record usage, offer follow-ups

Task Tracking

Create tasks in four groups. Mark each in_progress when starting, completed when done.

Group	When to create	Tasks
1	At start	Check prerequisites
2	After prerequisites pass	Inspect current headers · Assess and plan (skip "Assess and plan" in review mode)
3	After user approves changes	Apply changes (skip in review mode OR if no changes were accepted)
4	After apply or assess	Summarize (always)

1. Prerequisites

1.1 Locate the project, detect review mode

Use Glob to find **/powerpages.config.json. If $ARGUMENTS contains --review <out-dir>, remember the output directory — Steps 3–4 are skipped and Step 5 writes JSON only.

1.2 Verify site-settings directory

Check that .powerpages-site/site-settings/ exists. If not, the site has not been deployed yet — tell the user and recommend /deploy-site. Stop.

2. Inspect current headers

Use Glob to find all *.yml files in .powerpages-site/site-settings/. Use Read to read each file and extract the name and value fields. Identify all settings with an HTTP/ prefix — these are the configured headers.

Compare against the recognized header catalogue in references/headers-reference.md. For each header in the catalogue:

Present — record its current value.
Missing — record it as absent and note the recommended value from headers-reference.md.

…

View full docs ↗

Audit Power Pages table permissions and get prioritized security findings with fixes.

microsoftGet→

MCP

web-audit-mcp

Audit websites for performance, SEO, accessibility, security, and mobile readiness.

—Get→

MCP

sitehealth-mcp

Run website health audits for security, performance, email setup, and link issues.

—Get→

MCP

mcp-guard

Add security scanning, auditing, and vulnerability checks to Claude Code and Cursor.

—Get→

$ loading_