The Complete Production SOP: How to Deploy and Run Subresource Integrity (SRI) Hash Generator in Autonomous AI Agents
Step-by-step SOP to install and run the SRI Hash Generator skill in Codex, Claude Code, and Cursor. Automate SHA-384/512 hashes and supply-chain defense.
Technical Overview & Architectural Context
Autonomous coding agents frequently inject third-party script tags (e.g., Bootstrap, FontAwesome, Analytics, or Polyfills) directly from external CDNs without computing cryptographic Subresource Integrity (SRI) attributes. When prompted to secure these assets, LLMs commonly hallucinate hashes, output truncated SHA-256 strings instead of standard SHA-384/SHA-512 digests, or omit the vital 'crossorigin="anonymous"' attribute. Without explicit cross-origin declarations, modern browsers fail CORS verification, triggering complete silent blocking of critical client-side assets. The Subresource Integrity (SRI) Hash Generator skill constrains the agent's actions through strict, deterministic SOPs. It mandates the exact binary OpenSSL hashing pipelines (`openssl dgst -sha384 -binary file.js | openssl base64 -A`), dictates syntax validation on injected HTML script and link tags, enforces automatic base64 digest prefixing (`sha384-`), and establishes runtime CORS compliance guards. By embedding these checks directly into the agent's execution loop, web applications remain immune to CDN-level supply chain poisoning and silent rendering failures.
Prerequisites & Environment Requirements
Verified Search Intents & Long-Tail Queries Solved
This operational tutorial is engineered to provide deterministic solutions for these developer search queries:
Step-by-Step Execution Playbook
Local Environment Setup & SKILL.md Mounting
Create the local skill manifest directory and inject verified procedural rules.
Autonomous coding agents like Claude Code, Codex, Cursor, and Windsurf parse skills located in workspace-local `.agents/skills/` or system-wide `~/.agents/skills/` directories. Creating the designated folder structure and mounting the SKILL.md file enables the agent's semantic trigger engine to load the SRI generation procedure into memory during context ingestion.
mkdir -p ~/.agents/skills/subresource-integrity-sri-hasher && curl -fsSL https://askills.dev/api/skills/subresource-integrity-sri-hasher/raw -o ~/.agents/skills/subresource-integrity-sri-hasher/SKILL.md---
name: "subresource-integrity-sri-hasher"
description: "Protect web applications against compromised third-party CDNs with SRI hashes."
metadata:
author: "W3C WebAppSec"
version: "1.0.0"
runtime_compatibility:
- "codex"
- "claude-code"
- "cursor"
- "windsurf"
triggers:
- "generate sri hash for script"
- "add subresource integrity link"
- "verify cdn script hash"
permissions:
fs_read: true
fs_write: "workspace"
shell_exec: false
net_access: false
---
# Subresource Integrity (SRI) Hash Generator
Generates Subresource Integrity (SRI) sha384 and sha512 hashes for CDN-hosted scripts and stylesheets.
## Execution SOP & Rules
1. Compute hash using: openssl dgst -sha384 -binary <file> | openssl base64 -A
2. Include integrity="sha384-<hash>" on external <script> and <link> elements.
3. Always include crossorigin="anonymous" when loading resources with SRI.
4. Update integrity hashes automatically when upgrading external package versions.Place the SKILL.md inside `.cursor/rules/` or `.claude/skills/` as a symlink to prevent maintaining duplicate files across multiple IDE installations.
Do not alter the permission boundaries; granting unconstrained shell execution or net access risks agent-side command injection when processing untrusted URL strings.
Dependency Validation & Local Hashing Utility Verification
Ensure OpenSSL and cryptographic utilities are executable without exposing secrets.
The skill operates strictly within deterministic binary streams. Verify that the agent sandbox has access to OpenSSL with SHA-384 and base64 support to avoid LLM algorithmic hallucination of cryptographic checksums.
openssl version && which openssl base64#!/usr/bin/env bash
set -euo pipefail
ASSET_PATH="$1"
if [[ ! -f "$ASSET_PATH" ]]; then
echo "Error: File '$ASSET_PATH' not found." >&2
exit 1
fi
HASH=$(openssl dgst -sha384 -binary "$ASSET_PATH" | openssl base64 -A)
echo "sha384-${HASH}"Never allow the LLM to compute base64 hashes internally using token predictions. Always force execution via standard POSIX OpenSSL pipelines.
Newlines produced by standard base64 CLI can break HTML attribute parsing. Always use `openssl base64 -A` to output the string on a single contiguous line.
Intent Matching & Trigger Invocation
Verify deterministic activation using tested natural language prompts.
Agent runtimes monitor prompt tokens against frontmatter triggers: 'generate sri hash for script', 'add subresource integrity link', and 'verify cdn script hash'. Using declarative, trigger-aligned statements directs the agent to load the SOP rather than inferring arbitrary HTML modifications.
claude 'generate sri hash for script public/vendor/htmx.min.js and patch index.html'<!-- Updated by agent under subresource-integrity-sri-hasher SOP -->
<script
src="https://unpkg.com/[email protected]/dist/htmx.min.js"
integrity="sha384-D1Kt99CQMDuVetoL1lrYwg5t+9QdHe7NLX/SoJYkXDFfX37iInKRy5xLSi8nO7UC"
crossorigin="anonymous">
</script>Trigger the agent with explicit output targets (e.g., 'generate sri hash for script and enforce sha384') to skip clarifying round-trips.
Omitting the target filename or URL will cause the agent to prompt for user input, breaking non-interactive CI/CD agent runs.
Verification, Linting & Output Quality Gate
Execute automated self-healing checks before accepting agent deliverables.
Before committing changes, the agent must run local HTML linters or test scripts to confirm that both `integrity` and `crossorigin` attributes are present on all remote script or stylesheet references.
git diff -U1 public/index.html && npx html-validate public/index.html#!/usr/bin/env bash
# Validate all CDN scripts have integrity and crossorigin attributes
missing=$(grep -E '<script[^>]+src="http' public/index.html | grep -v 'integrity=' || true)
if [[ -n "$missing" ]]; then
echo "SRI Violation: Found external script missing integrity attribute:" >&2
echo "$missing" >&2
exit 1
fi
echo "All external CDN scripts comply with SRI policy."Include the verification command directly in your pre-commit hooks to halt PR merging if an agent strips SRI during template refactoring.
Avoid testing SRI against localhost HTTP servers without configured CORS headers, as local dev browsers will reject the script if `crossorigin="anonymous"` is present without `Access-Control-Allow-Origin: *`.
Real-World Scenario: Harden E-Commerce Checkout Template Against Third-Party CDN Compromise
“Add subresource integrity link and generate sri hash for script tags in checkout.html referencing external bootstrap and chartjs CDNs.”
Runtime Troubleshooting & Failure Modes
Root Cause: The asset was served with dynamic content-encoding (gzip/brotli) or modified in transit by CDN edge workers, or the SRI hash was calculated against a version with differing CRLF/LF line endings.
curl -sSL --compressed "https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" | openssl dgst -sha384 -binary | openssl base64 -ARoot Cause: Browsers strictly require explicit CORS mode when validating SRI for cross-origin assets. If crossorigin is omitted, browser security engines drop the resource.
sed -i 's/<script src="https:\/\/cdn/<script crossorigin="anonymous" src="https:\/\/cdn/g' public/index.htmlFrequently Asked Questions (Subresource Integrity (SRI) Hash Generator SOP)
Q:Can I use Subresource Integrity (SRI) Hash Generator across Codex, Claude Code, and Cursor simultaneously?
Yes. The skill conforms to the universal SKILL.md specification. You can place the file in the shared ~/.agents/skills/ directory or reference it in .cursorrules, CLAUDE.md, and Windsurf cascade workflows interchangeably.
Q:How does Subresource Integrity (SRI) Hash Generator prevent context window overflow during long agent sessions?
It provides compact, deterministic shell recipes for OpenSSL calculations and static checklist rules rather than injecting massive code libraries or broad prompt examples, keeping context footprint under 400 tokens.
Q:Does this skill require escalated root or container permissions?
No. The skill is audited with a 98/100 security score. It uses standard POSIX user-space utilities (openssl, curl) and restricts file modifications strictly to the local workspace boundary.
Ready to equip your autonomous agent with Subresource Integrity (SRI) Hash Generator?
Copy the complete audited SKILL.md specification or download the 1-click zip bundle directly from our verified registry.