Review Content-Security-Policy and security headers before merge

Write SKILL.md for reviewing Content-Security-Policy and companion security headers before merge. Focus on what the browser is allowed to load and frame. This is not a middleware auth review.

Repository context:
[where headers are set: next.config, middleware, netlify.toml, nginx, or a meta tag]
[environments: which policy is report-only vs enforcing]
[script hosts the product already needs: analytics, payments, fonts — names only]
[frame policy: may this app be embedded, and by which parents]

PR context (paste when using):
[PR link, header diff, reason the author gave]

SKILL.md must include:
1. Purpose — a wider script-src or a missing frame-ancestors turns an XSS or clickjack into a silent production bug.
2. When to use — any PR that edits CSP, HSTS, X-Frame-Options, Referrer-Policy, or Permissions-Policy. When not to use — route matcher or session-check changes with no header diff (middleware auth review), or copy edits.
3. Hard rules for findings:
   - Block: production policy adds 'unsafe-eval' or 'unsafe-inline' to script-src without a nonce or hash; script-src * or https: as a blanket host; object-src left as *; frame-ancestors removed or set to * on an authenticated app; enforcing policy replaced by report-only to clear console errors; CSP deleted from the response.
   - Warn: new third-party script host without a ticket naming the vendor; style-src 'unsafe-inline' expanded when a nonce already exists; missing base-uri 'self' or 'none'; missing form-action restriction; HSTS max-age lowered; Referrer-Policy moved to unsafe-url.
   - Note: report-to endpoint naming and header formatting — never block merge on whitespace alone.
4. Review steps the agent must execute:
   - Extract the before and after policy as directives, not as a single blob.
   - Mark each directive that became wider. A new host is wider. Dropping a nonce is wider.
   - Separate report-only from enforcing. A green report-only deploy is not an enforced policy.
   - Check frame-ancestors against the product's embed rules. Do not assume X-Frame-Options still wins when CSP is present.
   - Confirm the header is on document responses and on error pages the browser still renders.
5. PR comment template: directive diff table (directive — before — after — wider?), environment (report-only or enforce), findings, merge recommendation.
6. Safe patterns section: nonce or hash for scripts, explicit host list, frame-ancestors 'none' unless a parent is named, keep report-only only as a short-lived companion to an enforcing policy.
7. Two example prompts: add a payments script host vs turn on unsafe-inline to silence a styled-component warning.
8. Pitfalls: reviewing the meta tag and missing the header the CDN actually sends, copying a docs example with unsafe-inline, treating a staging report-only policy as the production one, ignoring service workers that ship their own policy.
9. Done means: every Block resolved, the effective production policy quoted in the comment, no new script host without an owner.

Rules:
- Do not invent directives that are not in the diff. If the current policy is absent from the paste, write [paste current CSP].
- Do not suggest disabling CSP on production routes.
- Output only SKILL.md markdown.