Marcel Brinkkemper

Okay, I guess you don’t want to update your plugin. I have made some changes to your plugin and it works for me now.

In my development environment, localhost, I develop for WordPress trunk and for current stable version. Both WordPress installs share a wp-content directory.
In wp-config I have:

define( 'WP_CONTENT_DIR', dirname(dirname(__FILE__)) . '/wp-content');
define( 'WP_CONTENT_URL', 'http://localhost/wp-content');

So my site urls are http://localhost/development/ and http://localhost/wordpress/ both share the content url of http://localhost/wp-content/

If have an alternative wp-content location, so my site_url is http://localhost/development/ and my content url is http://localhost/wp-content/.
I found some issues in the logic to determine if it is an external script:
in codestyling-localization.php on line 2554

if( stripos($url[1], content_url()) !== false && csp_plugin_denied_by_guard($url[1]) )

is false because the script is on content_url, but csp_plugin_denied_by_guard() returns false.
the next test on line 2564 tests on site_url() which will return false

elseif (stripos($url[1], get_site_url()) === false && !in_array($url[1], $csp_external_scripts['cdn']['scripts']))

I would propose to split the if statement on line 2554 in two parts, first check for content_url is true and the check for denied scripts, something like this:

if( stripos($url[1], content_url()) !== false ) {
  //internal scripts
  if ( csp_plugin_denied_by_guard($url[1]) ) {
    $dirty_scripts[] = $url[1];
    $dirty_index[] = $i;
    if (stripos($url[1], plugins_url()) !== false || stripos($url[1], content_url().'/mu-plugins') !== false) {
      $dirty_plugins[] = $url[1];
    }else{
      $dirty_theme[] = $url[1];
    }
  }
}