davila7/claude-code-templates · error

SEM_E015

SEM_E015

Error message

<iframe> tag detected (injection risk)

What it means

SEM_E015 is emitted by checkHtmlInjection when the lowercased content contains '<iframe'. Iframes in distributed markdown can embed remote, untrusted pages (clickjacking, drive-by content), so the validator reports any occurrence as an injection risk.

Source

Thrown at cli-tool/src/validation/validators/SemanticValidator.js:287

        });

        this.addError(code, message, {
          path,
          severity,
          matches: contexts.length,
          examples: contexts.slice(0, 3)
        });
      }
    }
  }

  /**
   * Check for HTML/Script injection attempts
   */
  checkHtmlInjection(content, path) {
    const dangerousTags = [
      { tag: '<script', code: 'SEM_E014', message: '<script> tag detected (XSS risk)' },
      { tag: '<iframe', code: 'SEM_E015', message: '<iframe> tag detected (injection risk)' },
      { tag: 'javascript:', code: 'SEM_E016', message: 'javascript: protocol detected (XSS risk)' },
      { tag: 'onclick=', code: 'SEM_E017', message: 'Inline event handler detected (XSS risk)' },
      { tag: 'onerror=', code: 'SEM_E018', message: 'onerror handler detected (XSS risk)' }
    ];

    for (const { tag, code, message } of dangerousTags) {
      const lowerContent = content.toLowerCase();
      if (lowerContent.includes(tag.toLowerCase())) {
        const index = lowerContent.indexOf(tag.toLowerCase());
        const lineInfo = this.getLineFromIndex(content, index);

        this.addError(code, message, {
          path,
          severity: 'critical',
          line: lineInfo.line,
          column: lineInfo.column,
          position: lineInfo.position,
          lineText: lineInfo.lineText,

View on GitHub (pinned to a0851ed10c)

Solutions

1. Escape the tag in documentation examples (&lt;iframe ...) or break it with a space ('< iframe')
2. Replace the embed with a plain markdown link to the resource
3. If embedding is a genuine feature, link the embed from the installed app rather than embedding it in component markdown

Example fix

# before
<iframe src="https://example.com"></iframe>
# after
[Open the dashboard](https://example.com)

if (component.content.toLowerCase().includes('<iframe')) {
  // replace with a markdown link or escape
}

When it happens

Trigger: validate() on content where content.toLowerCase().indexOf('<iframe') >= 0 — including '<iframes', partial prose like 'use <iframe elements', or legit embed examples inside code fences.

Common situations: Component docs showing how to embed a video or dashboard via an iframe example; components that intentionally embed external tooling UIs.

Related errors

• SEM_E011
• SEM_E012
• SEM_E013
• SEM_E014
• Invalid agent name

AI-assisted analysis of davila7/claude-code-templates@a0851ed10c (2026-08-28). Data as JSON: /api/errors/5d28640446b95c50. Report an issue: GitHub.