Now liveThe Skillselion MCP - thousands of ranked skills, loaded into your agent mid-task. No install.Get it →
erichowens avatar

Mdx Sanitizer

  • 138 installs
  • 178 repo stars
  • Updated July 14, 2026
  • erichowens/some_claude_skills

Sanitize untrusted MDX before render to block XSS, unsafe components, and malicious embeds in docs sites, blogs, and CMS-driven content platforms.

About

MDX sanitizer skill for securing content rendering pipelines against XSS and unsafe embedded components in documentation sites, marketing blogs, and CMS platforms. Use before shipping features that compile or render MDX from authors, imports, or third-party sources.

  • Blocks XSS in MDX content pipelines
  • Component and import allowlisting
  • Protects docs, blogs, and CMS renders
  • Handles untrusted author submissions
  • Pre-launch content security hardening

Mdx Sanitizer by the numbers

  • 138 all-time installs (skills.sh)
  • Ranked #922 of 2,203 Security skills by installs in the Skillselion catalog
  • Data as of Aug 4, 2026 (Skillselion catalog sync)
npx skills add https://github.com/erichowens/some_claude_skills --skill mdx-sanitizer

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

Listed on Skillselion
Installs138
repo stars178
Last updatedJuly 14, 2026
Repositoryerichowens/some_claude_skills

What it does

Sanitize untrusted MDX before render to block XSS, unsafe components, and malicious embeds in docs sites, blogs, and CMS-driven content platforms.

Files

SKILL.mdMarkdownGitHub ↗

MDX Sanitizer

Comprehensive MDX content sanitizer that prevents JSX parsing errors caused by angle brackets, generics, and other conflicting patterns.

The Problem

MDX 2.x treats unescaped < and { as JSX syntax. This causes build failures when content contains:

  • TypeScript generics: Promise&lt;T&gt;, Array&lt;string&gt;, Map&lt;K, V&gt;
  • Comparisons: &lt;100ms, &lt;=, &gt;=
  • Arrows: --&gt;, &lt;--, -&gt;
  • Invalid tags: &lt;link&gt; in prose, &lt;tag&gt; placeholders
  • Empty brackets: &lt;&gt;

Solution Architecture

This skill implements a three-layer defense:

1. Sync-Time Sanitization (Proactive)

Content is sanitized when syncing from .claude/skills/ to website/docs/:

  • syncSkillDocs.ts - Main skill files
  • syncSkillSubpages.ts - Reference files
  • doc-generator.ts - Generated docs

2. Pre-Commit Validation (Reactive)

The git pre-commit hook validates files before commit using validate-brackets.js.

3. Build-Time Validation (Final Check)

npm run validate:all runs as part of prebuild to catch any issues.

Usage

Check for Issues (Dry Run)

cd website
npm run sanitize:mdx
# or with verbose output
npm run sanitize:mdx -- --verbose

Fix All Issues

cd website
npm run sanitize:mdx -- --fix
# or shorthand
npm run fix:mdx

Programmatic API

import { sanitizeForMdx, validateMdxSafety, isMdxSafe } from './lib/mdx-sanitizer';

// Sanitize content
const result = sanitizeForMdx(content, { useHtmlEntities: true });
if (result.modified) {
  console.log(`Fixed ${result.issues.length} issues`);
  fs.writeFileSync(path, result.content);
}

// Validate without modifying
const issues = validateMdxSafety(content, 'path/to/file.md');

// Quick check
if (!isMdxSafe(content)) {
  // Handle issues
}

Escaping Strategies

The sanitizer uses HTML entities for maximum compatibility:

PatternOriginalEscaped
Less-than<&lt;
Greater-than>&gt;
Generics&lt;T&gt;&amp;lt;T&amp;gt;
Comparison&lt;=&amp;lt;=

Content inside code blocks (` ` or ``) is automatically protected and never escaped.

Files Modified

  • website/scripts/lib/mdx-sanitizer.ts - Core sanitizer module
  • website/scripts/sanitize-mdx.ts - CLI wrapper
  • website/scripts/syncSkillDocs.ts - Integration
  • website/scripts/syncSkillSubpages.ts - Integration
  • website/scripts/lib/doc-generator.ts - Integration
  • website/package.json - npm scripts

Patterns Detected

1. Less-than before digit: &lt;100, &lt;0.5ms 2. Comparison operators: &lt;=, &gt;= 3. Empty brackets: &lt;&gt; 4. Arrows: &lt;--, --&gt; 5. Generic types: Promise&lt;T&gt;, Array&lt;string&gt; 6. Space after less-than: &lt; value 7. Invalid pseudo-tags: &lt;link&gt;, &lt;tag&gt; (not valid HTML)

Troubleshooting

Build Still Fails After Running Sanitizer

1. Clear Docusaurus cache: npm run clear 2. Re-run sanitizer: npm run sanitize:mdx -- --fix 3. Rebuild: npm run build

False Positives

If valid JSX components are being escaped:

  • Ensure they use PascalCase (e.g., &lt;MyComponent&gt;)
  • Check they're valid HTML5 elements

Manual Escaping

For edge cases, manually escape in source:

  • Use backticks for inline code: ` &lt;T&gt; `
  • Use fenced code blocks for multi-line
  • Use HTML entities: &lt; and &gt;

Sources

Related skills

Securityappseccompliance

This week in AI coding

Five minutes, every Monday - the tools, releases and tactics for developers.

unsubscribe anytime.