Download export safety

Use this skill for browser-owned export surfaces where data leaves the app through a file download or clipboard write. The goal is not a broad security audit; it is to make export behavior reviewable, recoverable, and safe around spreadsheet interpretation, Blob URL lifetime, clipboard permission failures, and generated filenames.

Boundary with sibling skills

• Use download-export-safety for CSV/Excel formula risk, generated Blob/Object URLs, anchor downloads, clipboard copy/share, export filenames, and export-specific regression tests.
• Use frontend-security-baseline for raw HTML sinks, CSP, token storage, opener leaks, redirects, and generic browser security traps.
• Use payment-page-client-security when exported/copied data includes PAN/CVV or payment-page evidence.
• Use datetime-correctness when export values or filenames depend on timezone, DST, or date-only parsing.
• Use i18n-copy-and-layout for localized copy around export UI labels/messages.
• Use user-activation-contracts when the defect is that a gesture-gated clipboard or file-picker call runs after activation expires or another API consumes it. This skill still owns the outbound payload, rejected-call UI, fallback result, and file/Blob lifecycle.

Review workflow