browser-security

Name: browser-security
Author: pingminus

Implement or review AURORA navigation, permission, resource or bridge security controls.

by pingminus(0) 0 installs

Free

Free account. Installing gives you the manifest plus copy-paste snippets.

See reviews

About

Imported from pingminus/Aurora (skills/browser-security/SKILL.md). Install upstream with npx skills add pingminus/Aurora --skill browser-security. Copyright stays with the author.

browser-security

Architecture and workflow

Read docs/SECURITY.md and the actual CEF callbacks. Keep Chromium protections enabled and unsupported capabilities denied.

Define the capability and attacker-controlled inputs. Enforce policy in the browser process, constrain internal resource paths and avoid sensitive logs.

Common mistakes

Do not add insecure launch switches, bypass certificate failures, trust internal-looking URLs or grant capabilities through frontend-only checks.

Testing

Test negative cases from real web content where relevant, including subframes and external schemes; verify sandboxed native launch.

Review

Review isolation, authorization, fail-closed errors, profile boundaries and observability privacy.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

# after Install: the listing is in your workspace's routing pool - a plan picks it for its slot
curl -s -X POST https://api.opensmartroute.ai/api/v1/route -H 'Authorization: Bearer $OSR_API_KEY' -H 'Content-Type: application/json' -d '{"text": "...", "plan": true}'

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

pingminus-aurora-browser-security.ocm.jsonjson

{
  "ocm": "1",
  "id": "pingminus-aurora-browser-security",
  "kind": "skill",
  "name": "browser-security",
  "description": "Implement or review AURORA navigation, permission, resource or bridge security controls.",
  "publisher": "pingminus",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Implement or review AURORA navigation, permission, resource or bridge security controls."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/pingminus/Aurora",
      "path": "skills/browser-security/SKILL.md",
      "ref": "78caf404d7b9dd740ea76a5df2822bc3f5ec55db",
      "url": "https://github.com/pingminus/Aurora/blob/78caf404d7b9dd740ea76a5df2822bc3f5ec55db/skills/browser-security/SKILL.md",
      "key": "pingminus/Aurora/skills/browser-security/SKILL.md"
    }
  },
  "instructions": "# browser-security\n\n## Architecture and workflow\n\nRead docs/SECURITY.md and the actual CEF callbacks. Keep Chromium protections enabled and unsupported capabilities denied.\n\nDefine the capability and attacker-controlled inputs. Enforce policy in the browser process, constrain internal resource paths and avoid sensitive logs.\n\n## Common mistakes\n\nDo not add insecure launch switches, bypass certificate failures, trust internal-looking URLs or grant capabilities through frontend-only checks.\n\n## Testing\n\nTest negative cases from real web content where relevant, including subframes and external sc",
  "cost": {
    "context_tokens": 187
  }
}

Fetch it by URL: GET /api/v1/registry/pingminus-aurora-browser-security/manifest?version=1.0.0

About

browser-security

Architecture and workflow

Common mistakes

Testing

Review

Use it

Manifest

Reviews