Require https: protocol for remote content pack imports, rejecting http:, file:, javascript:, and other schemes. Add schema validation to verify required fields (id, name, items) and item shape (type, title) before accepting imported packs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>