Frontend Security

This runs systematic security audits on frontend codebases using grep searches for dangerous patterns like dangerouslySetInnerHTML, innerHTML assignments, eval calls, and unescaped Twig output. It covers XSS, CSRF, DOM manipulation vulnerabilities, and checks your CSP configuration across React, Astro, vanilla JS, and Node.js projects. The skill follows OWASP guidelines and outputs findings in a severity-ranked report with remediation steps. Worth running before any security review or deployment. The grep patterns are comprehensive enough to catch most common frontend vulnerabilities, though you'll still need to manually verify each finding since static analysis can't understand full context.

skills.sh installs: 449
GitHub stars: 7
last updated: Jun 3, 2026

View on GitHub

Install

$ npx -y skills add schalkneethling/webdev-agent-skills --skill frontend-security --agent claude-code

Installs into .claude/skills of the current project.

Files

Frontend Security Audit Skill

Perform comprehensive security audits of frontend codebases to identify vulnerabilities, bad practices, and missing protections.

Audit Process

Scan for dangerous patterns - Search codebase for known vulnerability indicators
Review framework-specific risks - Check for framework security bypass patterns
Validate defensive measures - Verify CSP, CSRF tokens, input validation
Check dependencies - Review npm/node dependencies for vulnerabilities
Report findings - Categorize by severity with remediation guidance

Critical Vulnerability Patterns to Search

XSS Indicators (Search Priority: HIGH)

# React dangerous patterns
grep -rn "dangerouslySetInnerHTML" --include="*.jsx" --include="*.tsx" --include="*.js"

# Direct DOM manipulation
grep -rn "\.innerHTML\s*=" --include="*.js" --include="*.ts" --include="*.jsx" --include="*.tsx"
grep -rn "\.outerHTML\s*=" --include="*.js" --include="*.ts"
grep -rn "document\.write" --include="*.js" --include="*.ts"

SKILL.md on GitHub