How do I install the Permissions Policy skill?

Run npx skillmds@latest add thedaviddias/permissions-policy in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Permissions Policy safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Permissions Policy?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Permissions Policy free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Permissions Policy?

thedaviddias (@thedaviddias) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Permissions Policy by thedaviddias — Agent Skill

Name: Permissions Policy
Author: thedaviddias

File contents

Set a Permissions-Policy header

A site compromised by XSS that has unrestricted camera and microphone access can silently record the user. Permissions-Policy limits which browser APIs are available, reducing attacker capabilities even after a successful injection.

Quick Reference

Use Permissions-Policy to disable browser features your site does not use (camera, microphone, geolocation, payment)
Syntax: Permissions-Policy: camera=(), microphone=(), geolocation=() — empty () means denied to all
Previously called Feature-Policy — the old syntax is deprecated and only supported in older browsers
Restricting unused features limits the blast radius if your site is compromised by XSS
Third-party iframes inherit page restrictions unless you explicitly grant them permissions

Check

Check whether the server sends a Permissions-Policy header and review which browser features are allowed or denied. Identify any powerful features (camera, microphone, geolocation, payment, USB) that are enabled but not required by the application.

Fix

Add a Permissions-Policy header that disables all browser features your site does not use. Start with camera=(), microphone=(), geolocation=() and expand the list based on what the application actually needs.

Explain

Explain what the Permissions-Policy header does, how it restricts browser APIs like camera and geolocation, and why disabling unused features improves security.

Code Review

Review server config, headers, forms, and integration points related to Set a Permissions-Policy header. Flag exact responses, cookies, or browser behaviors that violate the rule, and verify them against the effective production-like response.

For full implementation details, code examples, and framework-specific guidance, see references/rule.md.

Rule page: https://frontendchecklist.io/en/rules/security/permissions-policy

---name: permissions-policydescription: Use when reviewing HTTP response headers for defense-in-depth security hardening on any web application.---# Set a Permissions-Policy headerA site compromised by XSS that has unrestricted camera and microphone access can silently record the user. Permissions-Policy limits which browser APIs are available, reducing attacker capabilities even after a successful injection.## Quick Reference- Use `Permissions-Policy` to disable browser features your site does not use (camera, microphone, geolocation, payment)- Syntax: `Permissions-Policy: camera=(), microphone=(), geolocation=()` — empty `()` means denied to all- Previously called `Feature-Policy` — the old syntax is deprecated and only supported in older browsers- Restricting unused features limits the blast radius if your site is compromised by XSS- Third-party iframes inherit page restrictions unless you explicitly grant them permissions## CheckCheck whether the server sends a Permissions-Policy header and review which browser features are allowed or denied. Identify any powerful features (camera, microphone, geolocation, payment, USB) that are enabled but not required by the application.## FixAdd a Permissions-Policy header that disables all browser features your site does not use. Start with camera=(), microphone=(), geolocation=() and expand the list based on what the application actually needs.## ExplainExplain what the Permissions-Policy header does, how it restricts browser APIs like camera and geolocation, and why disabling unused features improves security.## Code ReviewReview server config, headers, forms, and integration points related to Set a Permissions-Policy header. Flag exact responses, cookies, or browser behaviors that violate the rule, and verify them against the effective production-like response.---For full implementation details, code examples, and framework-specific guidance,see `references/rule.md`.Rule page: https://frontendchecklist.io/en/rules/security/permissions-policy

Frequently asked questions

Permissions Policy