What happens at install time for Content Security Policy (CSP) Trusted Sites included in a package?

Question

When Remote Site Settings are packaged, for manual installs there is a prompt at install time to confirm the add of those settings to the org.

Looks like Content Security Policy (CSP) Trusted Sites are packageable; what happens at install time for those?

(Related information but not a direct answer here SFDX installing a managed package not deploying CSP trusted sites or remote site settings).

PS

Adding the text Rohit mentioned as I missed that when I first looked at the documentation so want to draw attention to it here:

When you include the CspTrustedSite component in a package, the permissions for the third-party APIs and Websocket connections apply to sites and pages across the org. Because this component modifies security, we don’t recommend including CspTrustedSite components in packages. Instead, we recommend that you instruct customers to use the CSP Trusted Sites Setup page or the CSPTrustedSites metadata API type to add the URLs to their allowlist as part of activating your package. If you choose to include CspTrustedSite components in your package, disclose this change prominently in your package documentation to ensure that your customers are aware of security modification.

Answer 1

I was able to find this documentation covering the CSP sites for managed packages.

As per above document , it is not recommended to include CSP Trusted sites in managed packages.

But as a managed package developer using CSP Trusted Sites in our package, I can confirm that while installing, below popup appears for user consent of CSP site :