# Openwebf Security Remote Content

> Review security risks and mitigations for remote WebF content (untrusted bundles, URL allowlists, HTTPS, trust boundaries, clickjacking). Use when the user mentions untrusted remote bundles, bundle URL validation/allowlists, or remote updates risk.

- Skill: `majiayu000/openwebf-security-remote-content` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/openwebf-security-remote-content`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/openwebf-security-remote-content/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/openwebf-security-remote-content

---


# OpenWebF Security: Remote Content & Trust Boundaries

## Instructions

1. Identify trust boundaries:
   - remote bundle URLs
   - user-generated content
   - bridge/native plugins
2. Review how URLs are constructed and validated (allowlists, HTTPS, pinning/versioning).
3. Use MCP docs (“Security”, “Store Guidelines”) as the baseline for recommendations.
4. Provide remediation steps ordered by severity; do not modify files by default.

If the user is primarily asking about store policy/compliance for remote updates, prefer `openwebf-security-store-guidelines`.

More:
- [reference.md](reference.md)
- [doc-queries.md](doc-queries.md)
- [examples.md](examples.md)