Skill · Version 1.0.0

Safe clipboard content

Converts pasted content into supported editor structures while rejecting active HTML and keeping copied block identities distinct.

clipboard-content-sanitization

Team members using this skill

AgentCraft

See how it helps

When is it useful?

Use when a rich-text editor accepts pasted web content or copied internal blocks.

What does it help you do?

Allows only supported document structures, safe attributes and approved URL schemes.
Normalizes external formatting while preserving useful paragraphs, lists and tables.
Regenerates pasted identifiers and supports plain text without executing active HTML.

Try asking this

Paste formatted Word content and an unsafe link into our editor, preserving structure while rejecting active content. The pasted table should keep its cells, while scripts and unsafe URL schemes disappear. Saving and reopening must preserve the sanitized document structure.

Detailed documentation

Read the skill’s original instructions, examples and checks in their authored language.

Details…Show less

Clipboard & Content Sanitization

Use this skill when implementing copy, cut, paste, or external content ingestion in visual and block editors.

Security First: Strict Allowlist Sanitization

Never Insert Unsanitized HTML or Active Content:
- External clipboard data (text/html, text/uri-list) is untrusted user input.
- Parse pasted HTML in an inert context (DOMParser or a strict sanitizer such as DOMPurify) and map it through an explicit schema allowlist before constructing editor nodes:
  - Strip all active/executable elements: <script>, <iframe>, <object>, <embed>, <svg onload>, <form>, <style>, <meta>, <link>.
  - Strip all inline event handlers and dangerous attributes: onerror, onload, onclick, style expressions that break editor layout (position: fixed/absolute, negative margins, z-index hijacking).
  - Validate URLs: Only allow safe URL schemes (https:, http:, mailto:, tel:, or approved relative paths) on links and media; reject javascript:, vbscript:, and untrusted data:text/html URIs.

Multi-Format Paste Resolution Pipeline

Inspect clipboardData in priority order and transform into valid schema transactions:

Internal Editor Slice (application/x-editor-slice or custom data attribute):
- Preserve full block fidelity when copying and pasting within the editor.
- Always regenerate block/node IDs on paste and remap internal links within the pasted slice so pasting never creates duplicate IDs in the document.
External Rich HTML (text/html from web pages, Word, Google Docs, Notion):
- Normalize foreign wrapper noise (<meta>, MsoNormal, <b style="font-weight:normal">, inline font families) into semantic editor blocks and marks (headings, lists, tables, bold, italic, links).
Plain Text (text/plain):
- Support plain-text paste (Cmd/Ctrl + Shift + V) and fallback when text/html is absent.
- Convert paragraph breaks into blocks or preserve line breaks inside code blocks, and optionally parse safe URLs or Markdown patterns when appropriate.
Pasted / Dropped Files & Images (clipboardData.files):
- Route pasted images/files through the project's validated upload pipeline (showing an upload placeholder/progress state and replacing with the permanent asset reference on completion, rather than persisting multi-megabyte base64 data: URLs directly inside the document JSON).

Checklist

Is all pasted HTML parsed inertly and filtered through a strict schema allowlist (blocking <script>, javascript: URLs, event handlers, and layout-breaking inline styles)?
Does copying and pasting blocks within the editor mint fresh unique IDs for all pasted nodes?
Does plain-text paste (Cmd/Ctrl+Shift+V) work cleanly across single-line and multi-paragraph selections?
Are pasted images/files uploaded through the storage pipeline instead of bloating the document with raw base64 strings?

Included files 1

SKILL.md