Why Browser Policy Matters​

Your browser is the #1 attack surface for most office workers. Phishing links, malicious extensions, HTTP sites that look legitimate — all of these land in the browser first.

The good news: Chrome and Edge both respect Windows Registry policies. You don't need a full MDM to lock them down. You just need the right registry keys and a way to deploy them.

How It Works​

Both Chrome and Edge read from:

HKLM\SOFTWARE\Policies\Google\Chrome\
HKLM\SOFTWARE\Policies\Microsoft\Edge\

Any value you write there overrides the browser's default behavior — and the user can't change it from the Settings UI. It's enforced silently, survives browser updates, and works identically whether the machine is on a domain or not.

15 Policies Worth Deploying​

Here's what I recommend as a baseline for any organization:

Deploying via PowerShell​

Each policy maps to a single registry value. A basic Set script looks like this:

#Requires -RunAsAdministrator

function Ensure-RegistryPath {
    param([string]$Path)
    if (-not (Test-Path $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }
}

$ChromePath = "HKLM:\SOFTWARE\Policies\Google\Chrome"
$EdgePath   = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"

Ensure-RegistryPath $ChromePath
Ensure-RegistryPath $EdgePath

# Enable Safe Browsing
Set-ItemProperty -Path $ChromePath -Name "SafeBrowsingEnabled" -Value 1 -Type DWord
Set-ItemProperty -Path $EdgePath   -Name "SmartScreenEnabled"  -Value 1 -Type DWord

And every Set script should have a matching Remove script that cleans up the keys:

#Requires -RunAsAdministrator

$ChromePath = "HKLM:\SOFTWARE\Policies\Google\Chrome"
$EdgePath   = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"

Remove-ItemProperty -Path $ChromePath -Name "SafeBrowsingEnabled" -ErrorAction SilentlyContinue
Remove-ItemProperty -Path $EdgePath   -Name "SmartScreenEnabled"  -ErrorAction SilentlyContinue

This is the Set/Remove pattern — for every policy you deploy, you have a clean rollback path.

Deploy via Action1​

If you're using Action1 (free up to 200 endpoints — the right choice for Vietnamese SMBs), deployment is straightforward:

1. Upload the .ps1 to Action1 → Scripts
2. Create a Policy, target by OU or tag
3. Set scheduled enforcement (weekly re-run to catch new machines)

The scripts run as SYSTEM with elevation, so no UAC prompts, no user interaction.

Skip GPO If You Can​

GPO works, but it has friction: you need a DC, you need the ADMX templates imported, and workgroup machines are excluded entirely. Registry-based PowerShell scripts work everywhere — domain, workgroup, Azure AD joined, hybrid. Same behavior, zero dependencies.

The only thing GPO gives you that scripts don't is real-time enforcement on policy change. For most SMBs, a weekly re-run schedule covers that gap.

Use the Generator​

Rather than writing these scripts by hand, I built a tool that generates ready-to-deploy Set and Remove .ps1 scripts for all 15 policies above:

Browser Policy Manager → pcs.io.vn/tools/browser-policy

Select the policies you want, configure the values, and download two files: Set-BrowserPolicy.ps1 and Remove-BrowserPolicy.ps1. Upload directly to Action1.

The tool covers Chrome and Edge simultaneously — one script pair, both browsers.

What's Actually In Here​

The repo is structured around four core components:

Plus language-specific rules for TypeScript, Python, Go, Java, Kotlin, Swift, C++, Rust, Perl, PHP, and more.

Claude-Only vs Cross-Agent​

The first thing to understand: most of this is Claude Code-specific.

Claude Code only:

• ~/.claude/skills/ — only Claude Code reads these
• ~/.claude/commands/ — slash command definitions
• ~/.claude/agents/ — subagent configs
• Hooks in settings.json — lifecycle events Claude Code fires

Cross-agent (works with Gemini, Cursor, etc.):

• rules/common/*.md — security and style guidelines any AI can follow
• mcp-configs/ — MCP server JSON configs, client-agnostic
• Any rule content you paste into a shared CLAUDE.md / AGENTS.md

If you run multiple AI environments (I use Claude Code + Antigravity/Gemini), the rules folder is the most transferable investment.

The Hooks Problem​

The hooks look powerful on paper:

{
  "PreToolUse": [
    {
      "matcher": "Bash",
      "hooks": [{ "type": "command", "command": "npx block-no-verify@1.1.2" }],
      "description": "Block --no-verify on git commits"
    }
  ]
}

But 90% of them reference ${CLAUDE_PLUGIN_ROOT}/scripts/hooks/*.js — Node.js scripts that only exist inside the installed plugin. You cannot cherry-pick the hooks JSON without installing the full package.

The simpler hooks (like block-no-verify) work standalone. The rest require install.ps1 --profile full.

What I Actually Kept (Cloudflare/React Stack)​

My stack is JavaScript, React/Docusaurus, and Cloudflare Workers — not Python or Java. Out of 156 skills, about 8 are directly relevant:

Skills worth keeping:

Commands worth keeping:

Agents worth keeping:

Rules worth merging into CLAUDE.md:

• rules/common/security.md — solid baseline checklist
• rules/common/coding-style.md — immutability, file organization

What I Skipped​

• All Python, Java, Kotlin, Swift, Android, Rust, PHP, Perl skills (not my stack)
• The full hooks system (requires Node.js environment + full install)
• Agent harness orchestration (overkill for a solo operator)

How to Install Selectively​

The repo ships install.ps1 / install.sh with --profile full or per-language flags:

# Install only what you need
.\install.ps1 typescript     # TypeScript rules only
.\install.ps1 --profile full  # Everything (156 skills, all rules)

For a selective cherry-pick without the installer:

# Copy only the skills you want
cp -r skills/security-review ~/.claude/skills/
cp -r skills/mcp-server-patterns ~/.claude/skills/
cp -r skills/api-design ~/.claude/skills/

# Copy useful commands
cp commands/code-review.md ~/.claude/commands/
cp commands/security-scan.md ~/.claude/commands/

# Copy common rules
cp rules/common/security.md ~/.claude/rules/

Bottom Line​

ECC is genuinely useful — but it's built for polyglot teams shipping TypeScript, Python, Go, Java, and Kotlin simultaneously. If your stack is narrower, install selectively.

The two things worth having regardless of stack:

1. rules/common/security.md — every project benefits from this checklist
2. skills/security-review/ — activates automatically when you touch auth code

Everything else: read the skill, decide if it matches your actual workflow, copy only what you'll actually invoke.

Stack: Cloudflare Workers + D1, Docusaurus 3.7, React 18, PowerShell. Running Claude Code (Pro) as primary coding environment.

Feel free to play around and edit this post as much as you like.