diff --git a/packages/app/src/composables/useContentPacks.ts b/packages/app/src/composables/useContentPacks.ts
index 70a0896c..bf600e07 100644
--- a/packages/app/src/composables/useContentPacks.ts
+++ b/packages/app/src/composables/useContentPacks.ts
@@ -108,14 +108,24 @@ export function useContentPacks() {
 
   async function importFromUrl(url: string): Promise<ContentPack | null> {
     try {
+      const parsed = new URL(url)
+      if (parsed.protocol !== 'https:') return null
+
       const response = await fetch(url)
       if (!response.ok) return null
       const data = (await response.json()) as ContentPack
-      if (!data.id || !data.name || !data.items) return null
+      if (
+        !data.id || typeof data.id !== 'string' ||
+        !data.name || typeof data.name !== 'string' ||
+        !Array.isArray(data.items) ||
+        !data.items.every((item: unknown) => {
+          const i = item as Record<string, unknown>
+          return i && typeof i.type === 'string' && typeof i.title === 'string'
+        })
+      ) return null
 
       const existing = installedPacks.value.find((p) => p.id === data.id)
       if (existing) {
-        // Update existing
         Object.assign(existing, data, { installedAt: Date.now(), source: url })
       } else {
         installedPacks.value.push({ ...data, installedAt: Date.now(), source: url })