# Build Secure Frontend Applications

Client-side vulnerabilities can expose users through unsafe rendering, navigation, and browser integrations. This skill provides practical guidance for secure frontend implementation and verification.

## Install

```bash
npx skillstore add sickn33/frontend-security-coder
```

## Metadata

- Status: approved
- Slug: sickn33-frontend-security-coder
- Skillstore revision: r1
- Version status: missing
- Tree hash: da1691819d02d2d8b8efd85d738adbdd427ef075919868f0e024a3b9fb70e49a
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/frontend-security-coder
- Ref: 88a8e9a07f4c54ab105c1c41b6267c287146b07b
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands
- Quality score: 78
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/sickn33-frontend-security-coder
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-frontend-security-coder/manifest

## Capabilities

- Identifies safer DOM APIs for rendering dynamic text and untrusted content.
- Recommends established sanitization libraries for permitted HTML content.
- Guides Content Security Policy design, staged deployment, and violation reporting.
- Reviews URL handling, redirects, external links, and iframe integrations.
- Covers browser controls including Trusted Types, SRI, CORP, and COEP.
- Suggests secure frontend patterns for authentication, service workers, and third-party widgets.

## Use Cases

- Secure a rendering feature: Choose safe DOM APIs and sanitization boundaries for user-controlled text or permitted HTML.
- Plan browser defenses: Define CSP, Trusted Types, SRI, framing, and cross-origin controls for an application.
- Review an integration: Evaluate redirects, authentication flows, widgets, payment forms, or service workers before release.

## Prompt Templates

### Secure dynamic text rendering

```
Review how [untrusted content] is rendered in [framework]. Explain the XSS risk and recommend safe DOM APIs.
```

### Design safe rich-text handling

```
Design a safe rich-text rendering flow for [application]. Include sanitization boundaries, allowed content, URL validation, and test cases.
```

### Plan a staged CSP rollout

```
Create a staged Content Security Policy for [application architecture]. Cover report-only deployment, nonces or hashes, third-party sources, reporting, and compatibility testing.
```

### Assess a complete frontend feature

```
Assess [frontend feature] for XSS, open redirects, clickjacking, token exposure, and third-party risks. Propose prioritized fixes and verification steps.
```

## Limitations

- Provides guidance only and does not execute scanners or test a running application.
- Requires project context to produce framework-specific and deployment-ready recommendations.
- Client-side controls cannot replace server-side validation, authorization, or output encoding.
- The referenced implementation playbook is not included in the scanned package.

## Best Practices

- Provide the framework, data source, trust boundary, and browser requirements with each request.
- Treat server validation, authorization, and secure headers as required companions to frontend controls.
- Deploy policies gradually, collect violations, and verify expected workflows before enforcement.

## Anti Patterns

- Do not insert untrusted values through HTML-parsing DOM APIs without established sanitization.
- Do not build custom sanitizers when a maintained, well-tested library meets the requirement.
- Do not store sensitive session tokens in browser storage without evaluating exposure and application architecture.

## Security Audit

- Audited at: 2026-07-23T23:07:05.206\+00:00
- Summary: The only static finding is a false positive: line 24 uses Markdown backticks to identify a documentation path, not execute a shell command. No prompt injection, exfiltration intent, executable code, or other semantic security issue was found in the scanned skill.

## Stats

- Views: 86
- Downloads: 10
- Favorites: 0
- Popularity score: 0