About

Imported from jeremylongshore/tons-of-skills-marketplace (plugins/saas-packs/stackblitz-pack/skills/stackblitz-security-basics/SKILL.md). Install upstream with npx skills add jeremylongshore/tons-of-skills-marketplace --skill stackblitz-security-basics. Copyright stays with the author (MIT).

StackBlitz Security Basics

Name: stackblitz-security-basics
Author: jeremylongshore

Overview

Secure WebContainer deployments: CSP headers, sandbox isolation, input validation.

Instructions

Step 1: WebContainer Security Model

WebContainers run in the browser sandbox -- no access to host filesystem, network is limited to HTTP, and all code runs in the user's browser tab. Key security points:

// WebContainers are inherently sandboxed:
// - No file system access to host
// - No raw network sockets
// - Memory isolated to browser tab
// - Cross-origin isolation via COOP/COEP headers

Step 2: Validate User Input

// If users can provide code to run in WebContainer, validate:
function sanitizeFileTree(tree: FileSystemTree): FileSystemTree {
  const sanitized: FileSystemTree = {};
  for (const [name, entry] of Object.entries(tree)) {
    // Block path traversal
    if (name.includes('..') || name.startsWith('/')) continue;
    // Block sensitive files
    if (name === '.env' || name.endsWith('.key')) continue;
    sanitized[name] = entry;
  }
  return sanitized;
}

Step 3: Content Security Policy

Content-Security-Policy: default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; frame-src https://*.webcontainer.io;

Security Checklist

COOP/COEP headers set correctly
User-provided code sandboxed in WebContainer
No secrets passed to WebContainer file system
CSP headers configured
Input validation on file paths

Resources

WebContainer Security

Next Steps

For production hardening, pair this checklist with stackblitz-rate-limits and stackblitz-debug-bundle.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/jeremylongshore-tons-of-skills-marketplace-stackblitz-se-ea1043/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

jeremylongshore-tons-of-skills-marketplace-stackblitz-se-ea1043.ocm.jsonjson

{
  "ocm": "1",
  "id": "jeremylongshore-tons-of-skills-marketplace-stackblitz-se-ea1043",
  "kind": "skill",
  "name": "stackblitz-security-basics",
  "description": "Secure WebContainer deployments: CSP headers, sandbox isolation, input validation. Use when working with WebContainers or StackBlitz SDK. Trigger: \"stackblitz security\".",
  "publisher": "jeremylongshore",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "saas",
      "ide",
      "webcontainers",
      "stackblitz",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Secure WebContainer deployments: CSP headers, sandbox isolation, input validation. Use when working with WebContainers or StackBlitz SDK. Trigger: \"stackblitz security\"."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/jeremylongshore/tons-of-skills-marketplace",
      "path": "plugins/saas-packs/stackblitz-pack/skills/stackblitz-security-basics/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/jeremylongshore/tons-of-skills-marketplace/blob/HEAD/plugins/saas-packs/stackblitz-pack/skills/stackblitz-security-basics/SKILL.md",
      "key": "jeremylongshore/tons-of-skills-marketplace/plugins/saas-packs/stackblitz-pack/skills/stackblitz-security-basics/SKILL.md"
    },
    "compatibility": "Designed for Claude Code",
    "allowed_tools": [
      "Read,",
      "Write,",
      "Grep"
    ],
    "license": "MIT"
  },
  "instructions": "# StackBlitz Security Basics\n\n## Overview\n\nSecure WebContainer deployments: CSP headers, sandbox isolation, input validation.\n\n## Instructions\n\n### Step 1: WebContainer Security Model\n\nWebContainers run in the browser sandbox -- no access to host filesystem, network is limited to HTTP, and all code runs in the user's browser tab. Key security points:\n\n```typescript\n// WebContainers are inherently sandboxed:\n// - No file system access to host\n// - No raw network sockets\n// - Memory isolated to browser tab\n// - Cross-origin isolation via COOP/COEP headers\n```\n\n### Step 2: Validate User Input\n\n``",
  "cost": {
    "context_tokens": 420
  }
}

Fetch it by URL: GET /api/v1/registry/jeremylongshore-tons-of-skills-marketplace-stackblitz-se-ea1043/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.