{"data":{"skill":{"slug":"sickn33-frontend-mobile-security-xss-scan","name":"frontend-mobile-security-xss-scan","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/frontend-mobile-security-xss-scan","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"055ca44c-921c-491b-8e12-33b84d1f0ed0","skill_id":"876a0253-b325-461e-9c0b-71385cac7383","version":6,"content_hash":"v3:88a8e9a07f4c54ab105c1c41b6267c287146b07b:204b5aa66497456afd6c9718212b59ffe589a6fb4ee07480d01e81e563211fd3:b31f718f24e31d11f6d9ca6ddd7a0a07b9628096f5d58d2e6306d0a4b20a604a:736b696c6c732f7369636b6e33332f66726f6e74656e642d6d6f62696c652d73656375726974792d7873732d7363616e:90f3255aee146ff8eecb971d7046bae1","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 24 static findings are false positives caused by Markdown fences, TypeScript template literals, documented security commands, and expected local file reads. A separate medium-severity logic flaw can suppress valid React findings when any sanitization term appears elsewhere in a file.","remediation":[{"issue":"The React scanner treats any file-wide DOMPurify or sanitize reference as proof that every unsafe HTML sink is protected.","severity":"medium","suggestion":"Trace each rendered value to its sink and verify that the exact value passes through an approved sanitizer immediately before rendering."}],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"SKILL.md","line_end":215,"line_start":215}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":153,"line_start":37},{"file":"SKILL.md","line_end":157,"line_start":153},{"file":"SKILL.md","line_end":174,"line_start":157},{"file":"SKILL.md","line_end":200,"line_start":174},{"file":"SKILL.md","line_end":204,"line_start":200},{"file":"SKILL.md","line_end":208,"line_start":204},{"file":"SKILL.md","line_end":217,"line_start":215},{"file":"SKILL.md","line_end":229,"line_start":227},{"file":"SKILL.md","line_end":243,"line_start":237},{"file":"SKILL.md","line_end":247,"line_start":243},{"file":"SKILL.md","line_end":257,"line_start":247},{"file":"SKILL.md","line_end":261,"line_start":257},{"file":"SKILL.md","line_end":267,"line_start":261},{"file":"SKILL.md","line_end":270,"line_start":267},{"file":"SKILL.md","line_end":273,"line_start":270},{"file":"SKILL.md","line_end":274,"line_start":273},{"file":"SKILL.md","line_end":275,"line_start":274},{"file":"SKILL.md","line_end":290,"line_start":275}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":60,"line_start":60}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"File-wide sanitization check can hide unsafe React sinks","locations":[{"file":"SKILL.md","line_end":150,"line_start":100}],"confidence":0.98,"description":"The React detector suppresses every matching sink when the file contains DOMPurify or sanitize anywhere, even when the vulnerable value never passes through that sanitizer.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The detector passes the complete file to hasSanitization, which returns true from a simple file-wide substring test. This directly creates false negatives."}],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":331,"audit_model":"codex","audited_at":"2026-07-23T23:04:18.352+00:00","created_at":"2026-07-26T12:24:23.650879+00:00","static_findings":[{"id":"scripts:SKILL.md:215:innerhtml-assignment-xss-risk","file":"SKILL.md","pattern":"innerHTML assignment (XSS risk)","snippet":"element.innerHTML = clean;`,","category":"scripts","line_end":215,"severity":"medium","line_start":215},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":153,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":157,"severity":"medium","line_start":153},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":174,"severity":"medium","line_start":157},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"description: `Pattern ${pattern} used without sanitization`,","category":"external_commands","line_end":200,"severity":"medium","line_start":174},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":204,"severity":"medium","line_start":200},{"id":"external_commands:SKILL.md:204:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":208,"severity":"medium","line_start":204},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"element.innerHTML = clean;`,","category":"external_commands","line_end":217,"severity":"medium","line_start":215},{"id":"external_commands:SKILL.md:227:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"}`,","category":"external_commands","line_end":229,"severity":"medium","line_start":227},{"id":"external_commands:SKILL.md:237:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":");`","category":"external_commands","line_end":243,"severity":"medium","line_start":237},{"id":"external_commands:SKILL.md:243:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":247,"severity":"medium","line_start":243},{"id":"external_commands:SKILL.md:247:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":257,"severity":"medium","line_start":247},{"id":"external_commands:SKILL.md:257:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":261,"severity":"medium","line_start":257},{"id":"external_commands:SKILL.md:261:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```typescript","category":"external_commands","line_end":267,"severity":"medium","line_start":261},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"report += `Total Findings: ${findings.length}\\n\\n`;","category":"external_commands","line_end":270,"severity":"medium","line_start":267},{"id":"external_commands:SKILL.md:270:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"report += `## ${severity.toUpperCase()} (${issues.length})\\n\\n`;","category":"external_commands","line_end":273,"severity":"medium","line_start":270},{"id":"external_commands:SKILL.md:273:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"report += `- **${issue.type}**\\n`;","category":"external_commands","line_end":274,"severity":"medium","line_start":273},{"id":"external_commands:SKILL.md:274:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"report += `  File: ${issue.file}:${issue.line}\\n`;","category":"external_commands","line_end":275,"severity":"medium","line_start":274},{"id":"external_commands:SKILL.md:275:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"report += `  Fix: ${issue.fix}\\n\\n`;","category":"external_commands","line_end":290,"severity":"medium","line_start":275},{"id":"filesystem:SKILL.md:60:node-js-fs-operations","file":"SKILL.md","pattern":"Node.js fs operations","snippet":"const content = await fs.readFile(file, 'utf-8');","category":"filesystem","line_end":60,"severity":"medium","line_start":60},{"id":"blocker:SKILL.md:298:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Avoid document.write entirely","category":"blocker","line_end":298,"severity":"low","line_start":298},{"id":"blocker:SKILL.md:309:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Avoid string-to-code patterns","category":"blocker","line_end":309,"severity":"low","line_start":309},{"id":"blocker:SKILL.md:315:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Avoid bypassing framework security features","category":"blocker","line_end":315,"severity":"low","line_start":315},{"id":"blocker:SKILL.md:253:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"semgrep --config=p/xss --json","category":"blocker","line_end":253,"severity":"low","line_start":253}],"finding_verdicts":[{"id":"scripts:SKILL.md:215:innerhtml-assignment-xss-risk","reason":"The assignment receives clean, which is produced by DOMPurify.sanitize(userInput) on the preceding line. It is explicitly presented as a secure remediation example.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"Line 37 opens a fenced TypeScript example. It is Markdown syntax, not Ruby or shell backtick execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:153:ruby-shell-backtick-execution","reason":"Line 153 closes a fenced TypeScript example. No command interpreter or execution mechanism is present.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:157:ruby-shell-backtick-execution","reason":"Line 157 opens another fenced TypeScript example. The backticks delimit Markdown and do not execute commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","reason":"This is a TypeScript template literal that formats a finding description. It neither invokes a shell nor evaluates the interpolated value as code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:200:ruby-shell-backtick-execution","reason":"Line 200 is a Markdown fence closing the framework scanner example. It has no command execution behavior.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:204:ruby-shell-backtick-execution","reason":"Line 204 opens a fenced TypeScript secure-coding example. The syntax is documentation, not shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:215:ruby-shell-backtick-execution","reason":"The backtick closes a TypeScript multiline string containing a DOMPurify example. It does not launch an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:227:ruby-shell-backtick-execution","reason":"The backtick terminates a TypeScript string containing a URL-validation example. No shell or Ruby execution is involved.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:237:ruby-shell-backtick-execution","reason":"The backtick terminates a TypeScript string containing a sanitized React example. It is not an executable shell construct.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:243:ruby-shell-backtick-execution","reason":"Line 243 closes a Markdown code fence. The delimiter itself cannot execute an external command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:247:ruby-shell-backtick-execution","reason":"Line 247 is a Markdown bash fence introducing transparent, standard security-tool examples. It is not Ruby backtick execution or concealed command invocation.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:257:ruby-shell-backtick-execution","reason":"Line 257 closes the documented bash example. The fence does not execute the commands it surrounds.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:261:ruby-shell-backtick-execution","reason":"Line 261 opens a fenced TypeScript report-generation example. It is Markdown syntax without an execution path.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","reason":"This TypeScript template literal formats a findings count in a report. It does not pass data to a shell or execute code.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:270:ruby-shell-backtick-execution","reason":"This TypeScript template literal formats a report heading from in-memory values. There is no command execution API or shell context.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:273:ruby-shell-backtick-execution","reason":"This line only interpolates a finding type into Markdown report text. It does not interpret the value as a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:274:ruby-shell-backtick-execution","reason":"This line formats a file and line location in a report string. It contains no shell invocation or executable sink.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:275:ruby-shell-backtick-execution","reason":"This line appends remediation text through a TypeScript template literal. The interpolated value is report content, not an executed command.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:SKILL.md:60:node-js-fs-operations","reason":"The scanner reads discovered source files from the user-selected directory for local analysis. The content is not modified, transmitted, or used for an unrelated purpose.","verdict":"false_positive","confidence":0.95},{"id":"blocker:SKILL.md:298:system-reconnaissance","reason":"The line is defensive guidance to avoid document.write. It performs no system discovery or reconnaissance.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:309:system-reconnaissance","reason":"The line advises against converting strings into code. It contains no system query, discovery command, or reconnaissance intent.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:315:system-reconnaissance","reason":"The line warns users not to bypass framework security features. It is preventive guidance and does not inspect the host system.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:253:network-reconnaissance","reason":"The Semgrep command runs a named XSS ruleset against local code and requests JSON output. It does not probe hosts, ports, services, or network topology.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[{"title":"File-wide sanitization check can hide unsafe React sinks","severity":"medium","locations":[{"file":"SKILL.md","line_end":150,"line_start":100}],"confidence":0.98,"description":"The React detector suppresses every matching sink when the file contains DOMPurify or sanitize anywhere, even when the vulnerable value never passes through that sanitizer.","confidence_reasoning":"The detector passes the complete file to hasSanitization, which returns true from a simple file-wide substring test. This directly creates false negatives."}],"subject_marketplace_commit_sha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","subject_content_hash":"204b5aa66497456afd6c9718212b59ffe589a6fb4ee07480d01e81e563211fd3","subject_tree_hash":"b31f718f24e31d11f6d9ca6ddd7a0a07b9628096f5d58d2e6306d0a4b20a604a","subject_plugin_path":"skills/sickn33/frontend-mobile-security-xss-scan","audit_payload_hash":"90f3255aee146ff8eecb971d7046bae1","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","contentHash":"204b5aa66497456afd6c9718212b59ffe589a6fb4ee07480d01e81e563211fd3","treeHash":"b31f718f24e31d11f6d9ca6ddd7a0a07b9628096f5d58d2e6306d0a4b20a604a","pluginPath":"skills/sickn33/frontend-mobile-security-xss-scan","auditPayloadHash":"90f3255aee146ff8eecb971d7046bae1"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-frontend-mobile-security-xss-scan/audits/6/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}