# iframe Injection

> Detects user-controlled content injected into iframe src attributes, enabling page embedding of malicious content.

- Skill: `zakirkun/iframe-injection` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/iframe-injection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/iframe-injection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/iframe-injection

---


# iframe Injection

## Overview
Injecting user-controlled URLs into `<iframe src="...">` allows attackers to embed arbitrary external content in the application's page, enabling:
- Content spoofing (fake login forms within trusted domain)
- Clickjacking of inner content
- Cross-site cookie access in older browsers

## Remediation
- Validate and whitelist iframe src URLs against allowed domains
- Use `sandbox` attribute on iframes
- Set CSP `frame-src` to restrict allowed iframe sources