CSP allows a wildcard source
The policy allows * as a source, so that resource type can load from any host.
Why it matters
A wildcard undoes the allowlist. For scripts, any site can supply code.
What to do
Replace * with the specific hosts you need.
Reference
CSP Level 3 defines the directives and source lists this check evaluates.