browser-security-dom-safety
Secure DOM sinks, URL parsing, messaging, storage, and browser capability boundaries against attacker-controlled content.
Skill by shubhamtaywade82
Chalk Labs
Need help deploying browser-security-dom-safety?
Chalk Labs sets up agents like this inside real teams: connected to your tools, tested on your data, with a human in the loop where it matters.
Install
Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.
npx agentmarket install skill/shubhamtaywade82-browser-security-dom-safety
Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.
Get the weekly diff
The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.
About
Use cases: security, writing
Reviews
Write a reviewNo reviews yet. Installed it? Reviews come from verified installers only. How reviews work
Permissions
What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.
- Tools
- No tools found
- Secrets
- None asked for
- Install scripts
- None found
Network hosts it talks to 1
codeload.github.com· found in install command
Files it touches
~/.claude/skills/browser-security-dom-safety
What's inside
- Skill name
browser-security-dom-safety- Description
- Secure DOM sinks, URL parsing, messaging, storage, and browser capability boundaries against attacker-controlled content.
- License
- MIT
- Instructions
- 27 lines in SKILL.md · view on GitHub
Files (1)
- SKILL.md
SKILL.md (first lines)
## Activate when Use when code reads from the DOM, URL, storage, postMessage, clipboard, drag and drop, HTML, iframe content, or browser-integrated APIs. ## Repository inspection Identify every data source, sink, origin check, sanitizer, encoding helper, CSP configuration, iframe sandbox policy, and message schema. ## Decision framework Prefer text or DOM APIs that do not parse HTML. Treat postMessage as an explicit protocol with origin and payload validation. Keep dangerous sinks isolated and reviewable. ## Implementation - Prefer textContent and framework-escaped rendering. - Require an explicit sanitizer contract before HTML insertion. - Validate message origin and payload shape. - Encode dynamic URL, query, and path components. - Validate storage contents as untrusted external data. - Constrain iframe origins and sandbox capabilities. ## Failure modes Watch for innerHTML injection, executable URL schemes, unsafe redirects, origin wildcard messaging, prototype pollution through parsed objects, and trust in persisted client data. ## Review Document source, transform, sink, and security invariant for each dangerous boundary. ## Verification Add adversarial tests for HTML, URL, message, storage, and malformed payload inputs. Run available security and static checks.
From shubhamtaywade82/react-agent-skills, MIT.
More from shubhamtaywade82/react-agent-skills
- 0.567score
agent-workflow
shubhamtaywade82
Use for any non-trivial React or TypeScript repository change to drive inspection, implementation, verification, and evidence reporting.
SkillAFreshness: AClaude Code +9 - 0.561score
agent-adversarial-evaluations
shubhamtaywade82
Probe frontend agents with prompt injection, unsafe dependencies, secret exposure, scope creep, security bypasses and test-cheating opportunities.
SkillAFreshness: AClaude Code +9 - 0.561score
agent-behavior-scoring
shubhamtaywade82
Score AI frontend agents on correctness, scope discipline, safety, execution quality and recovery using observable evidence.
SkillAFreshness: AClaude Code +9 - 0.561score
docker-kubernetes-frontend
shubhamtaywade82
Apply container and Kubernetes conventions for frontend build artifacts, runtime config, probes, caching and rollout safety.
SkillAFreshness: AClaude Code +9 - 0.561score
aws-frontend
shubhamtaywade82
Apply AWS frontend deployment conventions for S3/CloudFront, serverless/edge runtimes, cache invalidation and environment separation when present.
SkillAFreshness: AClaude Code +9 - 0.561score
apollo
shubhamtaywade82
Apply Apollo Client conventions for GraphQL cache identity, queries, mutations, fragments and normalization when Apollo is present.
SkillAFreshness: AClaude Code +9 - 0.561score
agent-evaluation-engineering
shubhamtaywade82
Design agent evaluations that separate execution success from correctness, scope discipline, safety and recovery behavior.
SkillAFreshness: AClaude Code +9 - 0.561score
agent-multi-turn-evaluations
shubhamtaywade82
Evaluate frontend agents across persistent workspaces and sequential turns requiring implementation, failure recovery and review-driven repair.
SkillAFreshness: AClaude Code +9 - 0.558score
agent-tool-capabilities
shubhamtaywade82
Define and verify the concrete tools available to an AI coding agent before planning frontend work.
SkillAFreshness: AClaude Code +9 - 0.558score
browser-authentication
shubhamtaywade82
Implement browser authentication flows with explicit cookie/token, CSRF, refresh, logout and session-expiry contracts.
SkillAFreshness: AClaude Code +9 - 0.558score
astro-react
shubhamtaywade82
Apply Astro + React integration conventions for islands, hydration directives and client boundaries when present.
SkillAFreshness: AClaude Code +9 - 0.558score
cypress
shubhamtaywade82
Apply Cypress-specific component or end-to-end testing conventions only when Cypress is detected.
SkillAFreshness: AClaude Code +9
Signals
- Stars
- 0
- Forks
- 0
- Open issues
- 0
- Last commit (this folder)
- Sep 27, 2026 (1 month ago)
From GitHub (fetched Oct 24, 2026).
Details
- License
- MIT
- First seen
- Oct 24, 2026
- Last checked
- Oct 24, 2026
- Source
- GitHubgithub-graphql
More from shubhamtaywade82
- 0.585score
derivatives-trading-usds-streams
shubhamtaywade82
Subscribe to live Binance USDⓈ-M futures WebSocket streams (market/public/private), read buffered payloads, and open user data streams for real-time…
SkillAFreshness: A★ 1Claude Code +9 - 0.584score
binance-usdm-futures-tools
shubhamtaywade82
LLM tool-calling + MCP + agent skill for Binance USD-M Futures.
SkillAFreshness: A★ 1Claude Code +9 - 0.584score
binance-futures-market-data
shubhamtaywade82
Use for read-only Binance USD-M Futures market data analysis, including prices, 24h tickers, order books, trades, klines, funding, mark price, open interest…
SkillAFreshness: A★ 1Claude Code +9 - 0.584score
binance-futures-paper-trading
shubhamtaywade82
Risk-free paper trading on Binance USD-M Futures using live market prices (no API keys required).
SkillAFreshness: A★ 1Claude Code +9 - 0.584score
binance-futures-trading
shubhamtaywade82
Place, modify, and cancel Binance USD-M Futures orders and manage positions/leverage/margin mode.
SkillAFreshness: A★ 1Claude Code +9 - 0.581score
derivatives-trading-usds
shubhamtaywade82
Trade Binance USDⓈ-M perpetual and quarterly futures with the binance-sdk package.
SkillAFreshness: A★ 1Claude Code +9
Done for you
Rather not set it up yourself?
Chalk Labs scopes, builds and runs agents for your team: the task audit, the eval harness, the integrations and the weekly ops report. Fixed scope, priced before we start.
See how we build AI agents →Read the case studies
Chalk Labs is a two-founder AI and growth studio. We build AI agents, CRMs and MVPs for Web3 and AI companies, and have shipped 50+ product and token launches.
- launches shipped
- 50+
- launches shipped
- media placements
- 500+
- media placements
- founders on every account
- 2
- founders on every account
Press we've placed: Forbes · CoinDesk · Decrypt · Cointelegraph · The Block
Rahil Jain, Co-founder, Chalk Labs. Ex-Goldman Sachs engineer. You talk to the person who builds it.
Get browser-security-dom-safety running in your business
Tell us what you want to automate. A founder replies within one working day with a plan, not a pitch deck.
Cite this page
browser-security-dom-safety skill. Agent Mart. https://agentmart.dev/skills/shubhamtaywade82-browser-security-dom-safety (last updated 2026-10-24)