📦
content-creator
88Create Brand-Consistent Marketing Content
Marketing teams need content that stays consistent across channels. This skill helps plan, write, analyze, and optimize content for brand voice and SEO.
Writing & Content View
Skills frontend-mobile-security-xss-scan
📦
frontend-mobile-security-xss-scan
Content revision r2 Medium Risk ⚡ Contains scripts⚙️ External commands📁 Filesystem access
Scan Frontend Code for XSS Risks
Unsafe client-side rendering can expose users to script injection. This skill reviews common frontend sinks and provides prioritized remediation guidance.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "frontend-mobile-security-xss-scan" from https://skillstore.io/skills/sickn33-frontend-mobile-security-xss-scan.md and its manifest at https://skillstore.io/api/skills/sickn33-frontend-mobile-security-xss-scan/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "frontend-mobile-security-xss-scan". Review a React component that renders customer-provided rich text.
Expected outcome:
- High: Unsafe HTML rendering accepts customer-controlled content.
- Verify that the exact rendered value passes through an allowlist-based HTML sanitizer.
- Prefer plain-text rendering when rich HTML is not required.
Using "frontend-mobile-security-xss-scan". Check a navigation helper that assigns a query parameter to the browser location.
Expected outcome:
- High: User-controlled URL data reaches a navigation sink.
- Allow only expected HTTP or HTTPS destinations.
- Reject script and data protocols before assignment.
Security Audit
Medium Riskv6 • 7/23/2026 Open versioned report
All 24 static findings are false positives caused by Markdown fences, TypeScript template literals, documented security commands, and expected local file reads. A separate medium-severity logic flaw can suppress valid React findings when any sanitization term appears elsewhere in a file.
1
Files scanned
331
Lines analyzed
0
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
File-wide sanitization check can hide unsafe React sinks
The React detector suppresses every matching sink when the file contains DOMPurify or sanitize anywhere, even when the vulnerable value never passes through that sanitizer.
The detector passes the complete file to hasSanitization, which returns true from a simple file-wide substring test. This directly creates false negatives.
Risk Factors
⚡ Contains scripts (1)
⚙️ External commands (18)
SKILL.md:37-153 SKILL.md:153-157 SKILL.md:157-174 SKILL.md:174-200 SKILL.md:200-204 SKILL.md:204-208 SKILL.md:215-217 SKILL.md:227-229 SKILL.md:237-243 SKILL.md:243-247 SKILL.md:247-257 SKILL.md:257-261 SKILL.md:261-267 SKILL.md:267-270 SKILL.md:270-273 SKILL.md:273-274 SKILL.md:274-275 SKILL.md:275-290
📁 Filesystem access (1)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-frontend-mobile-security-xss-scan/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-frontend-mobile-security-xss-scan?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-frontend-mobile-security-xss-scan?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-frontend-mobile-security-xss-scan/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-frontend-mobile-security-xss-scan.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). frontend-mobile-security-xss-scan security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-frontend-mobile-security-xss-scan/audits/6BibTeX citation
@techreport{sickn33-sickn33-frontend-mobile-security-xss-scan-2026,
author = {sickn33},
title = {frontend-mobile-security-xss-scan security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/sickn33-frontend-mobile-security-xss-scan/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "frontend-mobile-security-xss-scan security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/sickn33-frontend-mobile-security-xss-scan/audits/6"
identifiers:
- type: other
value: "skillstore:sickn33-frontend-mobile-security-xss-scan:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance
What You Can Build
Review a feature before merge
Check changed frontend components for unsafe HTML, URL assignments, and missing sanitization before code review.
Triage an XSS assessment
Create an initial list of likely client-side injection sinks for manual verification and prioritization.
Define secure rendering standards
Build a framework-specific checklist for React, Vue, Angular, and browser DOM code.
Try These Prompts
Check a frontend snippet
Review this frontend snippet for XSS risks. Identify unsafe sinks, explain each risk, and suggest a secure alternative: [paste snippet]
Review a framework component
Analyze this [React, Vue, or Angular] component for unsafe HTML rendering, URL injection, and sanitizer misuse: [paste component]
Triage repository findings
Review the frontend files in [path]. Prioritize exploitable XSS paths, list evidence, and separate confirmed issues from items needing manual validation.
Perform advanced source-to-sink analysis
Trace untrusted data from [sources] to HTML, script, URL, and event-handler sinks. Evaluate sanitization by context and document likely false negatives.
Best Practices
- Provide complete files or relevant data-flow context around each suspected sink.
- Verify every reported path manually before treating it as exploitable.
- Run framework tests and browser security tests after applying remediation.
Avoid
- Do not assume a sanitizer import proves that every rendered value is sanitized.
- Do not classify every innerHTML occurrence as exploitable without tracing its input.
- Do not replace contextual validation with simple keyword matching.
Frequently Asked Questions
Which frameworks does this skill cover?
It provides patterns for React, Vue, Angular, and vanilla browser JavaScript.
Does it modify application code?
No. It reviews code and proposes remediation unless the user separately requests edits.
Can it prove that an XSS issue is exploitable?
No. Findings require manual data-flow review and environment-specific validation.
Does it support native mobile applications?
No. The documented checks target web frontend code, not native iOS or Android APIs.
Does it require external tools?
Core guidance does not. Optional examples reference ESLint, Semgrep, DOMPurify, and a custom Node.js scanner.
How should sanitization findings be reviewed?
Confirm that the exact untrusted value uses a context-appropriate sanitizer immediately before reaching the sink.
Developer Details
Author
sickn33License
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Ref
88a8e9a07f4c54ab105c1c41b6267c287146b07b
Maintenance freshness
7/26/2026
Usage
11 downloads · 101 views
File structure
📄 SKILL.md
More from sickn33
View all📦
prompt-engineering-patterns
85Improve LLM Prompts With Proven Patterns
Inconsistent prompts waste time and make AI outputs hard to trust. This skill guides prompt design with reusable patterns, examples, evaluation steps, and optimization workflows.
Productivity View
📦
senior-fullstack
82Build Fullstack Apps with Senior Patterns
Teams need consistent setup, architecture, and review guidance for modern web applications. This skill provides scaffolders, workflow references, and quality prompts for React, Next.js, Node.js, GraphQL, and PostgreSQL projects.
Coding & Development View
📦
senior-architect
81Design Scalable Software Architectures
Architecture decisions are hard to compare across web, mobile, backend, and cloud systems. This skill provides structured guides and local scaffold scripts for reports, dependency review, and trade-off documentation.
Coding & Development View
📦
prompt-engineer
81Optimize AI Prompts With Prompt Engineer
Writing clear prompts is hard when goals are vague or complex. This skill turns rough requests into structured prompts using proven prompt frameworks.
Productivity View
📦
product-manager-toolkit
80Prioritize Product Work With Research Insights
Product teams need faster ways to rank features, synthesize interviews, and document decisions. This skill provides RICE scoring, interview analysis, and PRD templates for structured planning.
Productivity View
Related Skills
View all📦
security-gate
79Review Security Before Release
by DanielPodolsky
Teams miss security issues when release checks are informal. This skill guides Claude, Codex, and Claude Code through structured security questions and warning templates.
Security & Compliance View
📦
security-sentinel
79Audit Code for Security Risks
by Barnhardt-Enterprises-Inc
Security-sensitive code is easy to ship with hidden flaws in authentication, input handling, and secrets. This skill gives Claude, Codex, and Claude Code structured security references and scanner guidance for safer reviews.
Security & Compliance View
📦
security-audit
78Audit Application Security Before Deployment
by AppleLamps
Production reviews can miss command injection, excessive permissions, exposed secrets, and unsafe input handling. This skill provides a structured, read-only audit across backend and frontend controls.
Security & Compliance View
📦
security-fundamentals
78Review Code for Security Fundamentals
by DanielPodolsky
Security mistakes often appear in common areas like authentication, authorization, input handling, and data exposure. This skill gives Claude, Codex, and Claude Code a focused checklist for finding those risks during review.
Security & Compliance View
📦
memory-safety-patterns
77Apply Memory Safety Patterns
by wshobson
Memory bugs cause crashes, leaks, and security defects in systems software. This skill gives practical patterns for safer resource ownership across C, C++, and Rust.
Security & Compliance View
📦
skill-security
71Audit AI Agent Skills Before Installation
by superagent-ai
Unvetted agent skills can hide prompt injection, credential theft, persistence, or unsafe dependencies. This skill combines offline scanning with guided semantic review.
Security & Compliance View