Scan Headers
Quick security header check for a single URL
- Type
- Slash Command
- Repository
- jeremylongshore/tons-of-skills-marketplace
- GitHub stars
- 2.8k
- License
- MIT
- Repo last updated
- Sep 27, 2026
What Scan Headers is
Scan Headers is a slash command published in the jeremylongshore/tons-of-skills-marketplace repository on GitHub, which has about 2.8k stars. The repository describes itself as: “Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com.”
A slash command is a reusable prompt saved as a markdown file and run by typing its name after a slash. In Claude Code, custom commands have been merged into skills: a file in .claude/commands/ and a skill folder in .claude/skills/ both create the same kind of command, and existing command files keep working.
Scan Headers gives you a repeatable way to run the same instructions without retyping them, optionally with arguments.
How to install Scan Headers
Claude Code
- Download scan-headers.md from the repository.
- Save it to ~/.claude/commands/ (all projects) or .claude/commands/ (one project). As a skill, you can instead save it as ~/.claude/skills/<name>/SKILL.md.
- Run it by typing / followed by its name.
Claude Cowork
- Turn the command into a skill: create a folder with the file saved as SKILL.md and zip it.
- In Customize → Skills, click +, then upload the ZIP.
- Run it from any task with / and the skill name.
New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.
Inside the source file
An excerpt from plugins/security/penetration-tester/commands/scan-headers.md, shared under the repository's MIT license. Read the full file on GitHub.
Fast single-URL check for HTTP security headers. This is a shortcut for running just the header analysis from the full pentest workflow.
Usage
Ask the user for the target URL, then run:
python3 ${CLAUDE_PLUGIN_ROOT}/skills/performing-penetration-testing/scripts/security_scanner.py TARGET_URL --checks headersWhat Gets Checked
- Content-Security-Policy (CSP)
- Strict-Transport-Security (HSTS)
- X-Frame-Options
- X-Content-Type-Options
- Referrer-Policy
- Permissions-Policy
- Server version disclosure
- X-XSS-Protection (deprecated, informational)
Output
Present the results as a table showing each header, whether it's present, its value, and any issues found. Include the overall header security score.
For any missing or misconfigured headers, provide the recommended value and a brief explanation of what it protects against. Reference references/SECURITY_HEADERS.md for implementation details.
Authorization
Even though this only sends a single GET request, confirm the user has authorization to test the target URL before scanning.
Before you install
- Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
- Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
- Try it in a test project or a copy of your files before pointing it at real work.
- Pin the version you tested, and review changes before updating.
- Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.
FAQ
What is Scan Headers?
Scan Headers is a slash command for Claude Code and Claude Cowork from the jeremylongshore/tons-of-skills-marketplace repository on GitHub. Quick security header check for a single URL
How do I install Scan Headers in Claude Code?
Download scan-headers.md from the repository. Save it to ~/.claude/commands/ (all projects) or .claude/commands/ (one project). As a skill, you can instead save it as ~/.claude/skills/<name>/SKILL.md. Run it by typing / followed by its name.
Can I use Scan Headers in Claude Cowork?
Turn the command into a skill: create a folder with the file saved as SKILL.md and zip it. In Customize → Skills, click +, then upload the ZIP. Run it from any task with / and the skill name.
Is Scan Headers safe to install?
It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.
Similar resources
- Rag Architect Designs production RAG pipelines covering chunking strategy, embedding selection, retrieval patterns (basic, reranked, hybrid, multi-query), and evaluation metrics. Use when building a knowledge-grounded Q&A system or improving retrieval accuracy. Trigger with "design a RAG system", "help me build a knowledge base". Subagent · jeremylongshore/tons-of-skills-marketplace
- React Specialist React 18+ expert covering hooks, concurrent features, server components, state management (Zustand/Redux Toolkit), and performance optimization. Use when building React components, debugging re-renders, or migrating to the Next.js App Router. Trigger with \"React component help\", \"hook optimization\". Subagent · jeremylongshore/tons-of-skills-marketplace
- Rebase Interactive Guide through interactive rebase to clean commit history Slash Command · jeremylongshore/tons-of-skills-marketplace
- Ramp Pack Evidence-backed Ramp operator workflows for OAuth, cards, accounting, webhooks, security, reliability, and migration (24 skills) Plugin · jeremylongshore/tons-of-skills-marketplace
- Scan Movers Scan for top market movers across crypto, stocks, and forex with real-time Slash Command · jeremylongshore/tons-of-skills-marketplace
- Scan Scan codebase for security vulnerabilities Slash Command · jeremylongshore/tons-of-skills-marketplace
- Scan Secrets Scan for exposed secrets and credentials in codebase Slash Command · jeremylongshore/tons-of-skills-marketplace
- Run Load Test Run API load tests with k6, Artillery, or Gatling to measure performance Slash Command · jeremylongshore/tons-of-skills-marketplace