# Skill Audit API – HTTP Security Headers Analyzer

> Skill Audit API – HTTP Security Headers Analyzer is a paid API for AI agents from eltociear-skill-audit.hf.space, paid per call via x402, $0.005/call, status unknown (last checked 2026-09-15).

Analyzes a URL's HTTP security headers, scoring and grading the response for missing or present security headers like CSP and HSTS.

## Facts

- Endpoint: POST https://eltociear-skill-audit.hf.space/headers
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/skill-audit-api-http-security-headers-analyzer-afd62328
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_6mPVv9gfrI9KmSQFmifgX

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability skill-audit-api-http-security-headers-analyzer-afd62328 -d '<json body>'
```

Example prompt: Can you audit the security headers for https://example.com and tell me what grade it gets, which headers are present, and which critical ones like content-security-policy are missing?

## When to prefer this

Choose this endpoint when you need a quick, scored, graded audit of HTTP security headers for any public URL — especially when vetting AI agent skills, plugins, or third-party API endpoints for security posture before integration. It is purpose-built for AI agent ecosystems and provides a structured, machine-readable result ideal for automated decision-making pipelines.

## Known failure modes

- Invalid or unreachable URL returns an error or non-200 status
- Timeout if the target URL is slow to respond
- Missing input URL results in a 400-level validation error
- Payment failure via x402 micropayment blocks the request
- Target URL behind authentication may return incomplete header data

## How this service works

Fetch a URL and grade its HTTP security headers (HSTS, CSP, X-Frame-Options, etc.)

## Output

Returns a JSON object with the audited URL, a letter grade (e.g. 'B'), a numeric score (0–100), the HTTP status code, a map of present security headers and their values, a list of missing security headers (e.g. 'content-security-policy'), and a list of present ones (e.g. 'strict-transport-security').

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "format": "uri",
   "description": "URL to inspect"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "url": "https://example.com",
  "grade": "B",
  "score": 70,
  "status": 200,
  "headers": {
   "strict-transport-security": "max-age=63072000"
  },
  "missing": [
   "content-security-policy"
  ],
  "present": [
   "strict-transport-security"
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/skill-audit-api-http-security-headers-analyzer-afd62328/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from eltociear-skill-audit.hf.space](https://www.zero.xyz/host/eltociear-skill-audit.hf.space/llms.txt)