Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →hashgraph-online/htmx-security
Review and harden security for htmx and server-driven web apps.
Passed 21 of 24 test cases with the skill, and 19 of 24 without it.
2 fixed19 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
An htmx action button on `app.example.com` sends an `hx-post` directly to `api.thirdparty.com` with `hx-include` parameters. What origin and credential baseline rules apply to htmx network requests?
| Checked | Without skill | With skill |
|---|---|---|
| Requires keeping htmx requests same-origin by default | Missed | Passed |
| Requires explicit design of CORS and credentials if cross-site htmx requests are used | Passed | Passed |
The instructions your model reads when the skill loads.
Use this skill before shipping htmx features that render user content, accept rich HTML, add third-party scripts, change Content Security Policy, or expose new mutation endpoints.
htmx keeps rendering on the server, but unsafe HTML is still unsafe HTML. A fragment swap can insert scripts, event handlers, dangerous URLs, or htmx attributes that cause requests. Treat every fragment as executable browser surface unless it is escaped or sanitized.
hx-*, data-hx-*, hx-on, inline event handlers, script, dangerous URLs, and style features that the product does not explicitly allow.Choose one content policy:
| User content type | Policy |
|---|---|
| Plain text | Escape and render as text |
| Markdown | Render through a sanitizer and allow only safe tags/attributes |
| Rich HTML | Sanitize with a narrow allowlist and strip htmx/event/script capabilities |
| Trusted admin HTML | Still sanitize unless the trust boundary is documented and access is tightly controlled |
Do not mark content safe merely because it was stored in the database earlier.
hx-get, hx-post, hx-put, hx-patch, hx-delete, or hx-trigger can create unintended requests.hx-on or inline handlers can execute JavaScript.hx-vals can smuggle unexpected parameters.Use hx-history="false" on sensitive pages or containers that should not be stored in htmx history cache.
test cases passed, vs 19 / 24 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.