>After initial hesitation, I decided to try and track down the actual reason the CSP was being triggered and 
I believe this may be a Chrome issue and not related to the plugin at all. If I disable all my extensions and access https://raw.githubusercontent.com/asciidoctor/asciidoctor/master/README.adoc I still get the error.

Interesting... I think we can go with your suggestion:
```javascript
details.responseHeaders[i].value = "default-src 'none'; style-src 'self' 'unsafe-inline';";
```

If this is not related to the plugin I think it's better to use the little less restrictive CSP just to solve the issue and keep the restrictive default CSP for the manifest.