Security

This is a proper hardening workflow for Flows apps that actually fixes vulnerabilities instead of just listing them. It walks through six steps in order: mapping attack surfaces, migrating raw CDF calls to the official SDK, eliminating hardcoded secrets, sanitizing dangerous DOM APIs with DOMPurify, checking auth guards and OIDC setup, and validating external input with Zod. The grep commands are specific and the fix instructions are concrete, like wrapping dangerouslySetInnerHTML with DOMPurify.sanitize() or replacing eval() with JSON.parse(). Run this before shipping anything that touches credentials, user input, or external data. It assumes a React/Vite/TypeScript stack and catches the most common ways developers accidentally introduce XSS or injection holes.

skills.sh installs: 1.9K
GitHub stars: 6
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add cognitedata/builder-skills --skill security --agent claude-code

Installs into .claude/skills of the current project.

Files

Security Fix

Find and fix security issues in $ARGUMENTS (or the whole app if no argument is given). Work through every step below in order. Every step that finds an issue must also fix it.

Step 1 — Map the attack surface

Read these files before checking anything:

src/main.tsx / src/App.tsx — entry point, routing, auth gating
vite.config.ts — dev server proxy, CORS, headers
package.json — list of third-party dependencies
Any file matching **/auth*, **/login*, **/token*, **/credential*

Identify:

All pages/routes and whether each is behind an auth guard
All places where external data enters the app (CDF SDK calls, fetch, user form input)
All places where data is written back (CDF upsert, fetch POST/PUT/DELETE)

Step 2 — Migrate all CDF access to the Cognite SDK

All traffic to Cognite Data Fusion (CDF) must go through the official Cognite SDK. Find any HTTP, WebSocket, or other network call to CDF-like hosts or APIs that bypasses the SDK and rewrite it to use the SDK.