frontend-security

schalkneethling's avatarfrom schalkneethling

Audit frontend codebases for security vulnerabilities and bad practices. Use when performing security reviews, auditing code for XSS/CSRF/DOM vulnerabilities, checking Content Security Policy configurations, validating input handling, reviewing file upload security, or examining Node.js/NPM dependencies. Target frameworks include web platform (vanilla HTML/CSS/JS), React, Astro, Twig templates, Node.js, and Bun. Based on OWASP security guidelines.

⭐0stars🔀0forks📁View on GitHub🕐Updated Jan 5, 2026
[Code Review]

When & Why to Use This Skill

This Claude skill automates comprehensive frontend security audits to identify vulnerabilities and enforce best practices. By leveraging OWASP security guidelines, it scans codebases for XSS, CSRF, and DOM-based risks across modern frameworks like React, Node.js, and Astro, ensuring robust input validation and secure dependency management.

Use Cases

  • Pre-merge Security Audits: Automatically scan pull requests for dangerous patterns such as 'dangerouslySetInnerHTML' or unsafe DOM manipulations to prevent vulnerabilities from reaching production.
  • Dependency Risk Management: Review Node.js and NPM dependencies to identify known security flaws and ensure the supply chain remains secure and up-to-date.
  • Compliance & Policy Verification: Validate Content Security Policy (CSP) configurations and CSRF token implementations to ensure the application meets industry-standard security protocols.
  • Framework-Specific Vulnerability Detection: Perform targeted reviews for specific environments like React, Astro, or Twig templates to catch framework-specific security bypass patterns.
namefrontend-security
descriptionAudit frontend codebases for security vulnerabilities and bad practices. Use when performing security reviews, auditing code for XSS/CSRF/DOM vulnerabilities, checking Content Security Policy configurations, validating input handling, reviewing file upload security, or examining Node.js/NPM dependencies. Target frameworks include web platform (vanilla HTML/CSS/JS), React, Astro, Twig templates, Node.js, and Bun. Based on OWASP security guidelines.

Frontend Security Audit Skill

Perform comprehensive security audits of frontend codebases to identify vulnerabilities, bad practices, and missing protections.

Audit Process

  1. Scan for dangerous patterns - Search codebase for known vulnerability indicators
  2. Review framework-specific risks - Check for framework security bypass patterns
  3. Validate defensive measures - Verify CSP, CSRF tokens, input validation
  4. Check dependencies - Review npm/node dependencies for vulnerabilities
  5. Report findings - Categorize by severity with remediation guidance

XSS Indicators (Search Priority: HIGH)

# React dangerous patterns
grep -rn "dangerouslySetInnerHTML" --include="*.jsx" --include="*.tsx" --include="*.js"

# Direct DOM manipulation
grep -rn "\.innerHTML\s*=" --include="*.js" --include="*.ts" --include="*.jsx" --include="*.tsx"
grep -rn "\.outerHTML\s*=" --include="*.js" --include="*.ts"
grep -rn "document\.write" --include="*.js" --include="*.ts"

# URL-based injection
grep -rn "location\.href\s*=" --include="*.js" --include="*.ts"
grep -rn "location\.replace" --include="*.js" --include="*.ts"
grep -rn "window\.open" --include="*.js" --include="*.ts"

# Eval and code execution
grep -rn "eval\s*(" --include="*.js" --include="*.ts"
grep -rn "new Function\s*(" --include="*.js" --include="*.ts"
grep -rn "setTimeout\s*(\s*['\"]" --include="*.js" --include="*.ts"
grep -rn "setInterval\s*(\s*['\"]" --include="*.js" --include="*.ts"

# Twig unescaped output
grep -rn "|raw" --include="*.twig" --include="*.html.twig"
grep -rn "{% autoescape false %}" --include="*.twig"

CSRF Indicators

# Forms without CSRF tokens
grep -rn "<form" --include="*.html" --include="*.jsx" --include="*.tsx" --include="*.twig"

# State-changing requests without protection
grep -rn "fetch\s*(" --include="*.js" --include="*.ts" | grep -E "(POST|PUT|DELETE|PATCH)"
grep -rn "axios\.(post|put|delete|patch)" --include="*.js" --include="*.ts"

Sensitive Data Exposure

# localStorage/sessionStorage with sensitive data
grep -rn "localStorage\." --include="*.js" --include="*.ts"
grep -rn "sessionStorage\." --include="*.js" --include="*.ts"

# Hardcoded secrets
grep -rn "api[_-]?key\s*[:=]" --include="*.js" --include="*.ts" --include="*.env"
grep -rn "secret\s*[:=]" --include="*.js" --include="*.ts"
grep -rn "password\s*[:=]" --include="*.js" --include="*.ts"

Reference Documentation

Load these references based on findings:

  • XSS vulnerabilities found: See references/xss-prevention.md
  • CSRF concerns: See references/csrf-protection.md
  • DOM manipulation issues: See references/dom-security.md
  • CSP review needed: See references/csp-configuration.md
  • Input handling issues: See references/input-validation.md
  • Node.js/NPM audit: See references/nodejs-npm-security.md
  • Framework-specific patterns: See references/framework-patterns.md
  • File upload handling: See references/file-upload-security.md
  • JWT implementation: See references/jwt-security.md

Severity Classification

CRITICAL - Exploitable XSS, authentication bypass, secrets exposure HIGH - Missing CSRF protection, unsafe DOM manipulation, SQL injection vectors MEDIUM - Weak CSP, missing security headers, improper input validation LOW - Informational disclosure, deprecated functions, suboptimal practices

Report Format

## Security Audit Report

### Summary
- Critical: X findings
- High: X findings
- Medium: X findings
- Low: X findings

### Critical Findings

#### [CRITICAL-001] Title
- **Location**: file:line
- **Pattern**: Code snippet
- **Risk**: Description of the vulnerability
- **Remediation**: How to fix
- **Reference**: OWASP link

### High Findings
[...]

For comprehensive guidance, consult these OWASP cheatsheets directly: