The Agent Skills Directory

[SAFE]: The skill instructions promote secure handling of postMessage by requiring strict origin and source verification, which effectively prevents data leaks and unauthorized command execution across frame boundaries.
[SAFE]: Recommendations for sandbox and Permissions-Policy follow the principle of least privilege, ensuring that embedded content is restricted to only the necessary capabilities.
[SAFE]: The provided test scripts (fixture_server.py and browser_smoke.cjs) establish a secure local environment for verifying security policies using loopback addresses, avoiding external network risks.
[SAFE]: The technical guidance correctly identifies frame-ancestors as the primary defense against clickjacking and provides appropriate instruction for managing partitioned storage and third-party cookie restrictions.
[SAFE]: No malicious patterns such as prompt injection, persistence mechanisms, or credential exfiltration were detected in the instructions or code files.

iframe-embed-contracts