Skills web-development
📦
web-development
v2.23.8 Content revision r1 High Risk ⚙️ External commands🔑 Env variables🌐 Network access📁 Filesystem access
Build Reliable Web Frontends
Frontend work often fails when framework conventions, browser validation, and deployment rules are mixed together. This skill gives agents a structured path for React, Vue, Vite, and CloudBase web work.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "web-development" from https://skillstore.io/skills/tencentcloudbase-web-development.md and its manifest at https://skillstore.io/api/skills/tencentcloudbase-web-development/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "web-development". Fix a broken login redirect in a React app.
Expected outcome:
- Identifies the route guard and login handler that own the redirect.
- Applies a focused fix without changing unrelated pages.
- Reports typecheck, build, and browser validation results.
Using "web-development". Deploy a Vite SPA to CloudBase static hosting.
Expected outcome:
- Confirms build output, asset paths, and routing mode.
- Calls out the required index error document for history routing.
- Lists deployment checks and any unverified credentials.
Using "web-development". Add CloudBase data loading to a Vue page.
Expected outcome:
- Keeps SDK setup within the existing frontend structure.
- Verifies loading, empty, success, and error states in the browser.
- Separates Web SDK work from unrelated backend changes.
Security Audit
High Riskv2 • 7/9/2026 Open versioned report
Most static findings are false positives caused by Markdown inline code, documentation URLs, and fixed sibling-skill paths. Confirmed risks involve unpinned remote instruction URLs and a public frontend access-key example. Semantic findings also identify unsafe token-cookie and credentialed CORS guidance.
3
Files scanned
471
Lines analyzed
8
Review items
0
False positives ignored
Confirmed security concerns (4)
High
Environment file access
accessKey: process.env.NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY!,
The sample places CLOUDBASE_ACCESS_KEY in a NEXT_PUBLIC variable, which Next.js exposes to browser bundles. If the value is a secret key, users following the sample leak credentials.
High
Client-Side Token Cookie Guidance
The Next.js example writes a session access token with document.cookie and later reads it from a request cookie. A JavaScript-readable token cookie is exposed to XSS and omits Secure, HttpOnly, and SameSite protections.
The example directly stores data.session.access_token in document.cookie and then reads cloudbase_token from request cookies. The security weakness follows from the documented flow.
Medium
Permissive Credentialed CORS Example
The NestJS sample allows an origin fallback of * while credentials are enabled. This can teach deployments to combine credentialed requests with overly broad origins.
The CORS example shows a wildcard origin fallback and credentials enabled in the same configuration block. This is a clear unsafe deployment pattern.
Medium
Mutable Remote Instruction Dependency
The standalone instructions tell agents to use raw main-branch URLs for protocols and sibling skills. Unpinned remote instructions can change after marketplace review and alter agent behavior.
The URLs are explicit raw references to main-branch skill and protocol content. The risk is mutable remote instruction loading, not a generic hardcoded URL.
Capability review items (8)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Environment variable access (dot notation)
accessKey: process.env.NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY!,
The example reads a variable named NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY in browser initialization. NEXT_PUBLIC values are exposed to the client, so a secret access key would leak.
High
Environment variable object
accessKey: process.env.NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY!,
The example reads a variable named NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY in browser initialization. NEXT_PUBLIC values are exposed to the client, so a secret access key would leak.
Low
Hardcoded URL
- CloudBase main entry: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/sk
The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.
Low
Hardcoded URL
- Current skill raw source: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/mai
The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.
Low
Hardcoded URL
- Change Safety Protocol: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/
The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.
Low
Hardcoded URL
- Deployment Gate: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/skills/
The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.
Low
Hardcoded URL
- Login flow -> `../auth-tool/SKILL.md` (standalone fallback: `https://cnb.cool/tencent/cloud/cloudb
The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.
Low
Hardcoded URL
- Official Account JSAPI Pay, Native QR-code Pay, or WeChat OAuth on CloudBase -> `../cloudbase-wech
The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.
Risk Factors
⚙️ External commands (48)
frameworks.md:46-56 SKILL.md:10 SKILL.md:12 SKILL.md:13 SKILL.md:15 SKILL.md:18 SKILL.md:19 SKILL.md:34 SKILL.md:35 SKILL.md:39 SKILL.md:40 SKILL.md:41 SKILL.md:42 SKILL.md:49 SKILL.md:57 SKILL.md:66 SKILL.md:68 SKILL.md:69 SKILL.md:70 SKILL.md:71 SKILL.md:72 SKILL.md:73 SKILL.md:74 SKILL.md:78 SKILL.md:79 SKILL.md:85 SKILL.md:86 SKILL.md:87 SKILL.md:92 SKILL.md:100 SKILL.md:115 SKILL.md:116 SKILL.md:117 SKILL.md:129 SKILL.md:130 SKILL.md:133 SKILL.md:138 SKILL.md:158 SKILL.md:159 SKILL.md:171 SKILL.md:172 SKILL.md:178 SKILL.md:186 SKILL.md:189-191 SKILL.md:191-194 SKILL.md:194-196 SKILL.md:196-200 SKILL.md:200-209
🔑 Env variables (10)
🌐 Network access (6)
📁 Filesystem access (2)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/tencentcloudbase-web-development/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/tencentcloudbase-web-development?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/tencentcloudbase-web-development?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/tencentcloudbase-web-development/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/tencentcloudbase-web-development.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
tencentcloudbase. (2026). web-development security audit report (audit version 2) [Author version 2.23.8]. Skillstore. https://skillstore.io/skills/tencentcloudbase-web-development/audits/2BibTeX citation
@techreport{tencentcloudbase-tencentcloudbase-web-development-2026,
author = {tencentcloudbase},
title = {web-development security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/tencentcloudbase-web-development/audits/2},
note = {Author version 2.23.8}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "web-development security audit report (audit version 2)"
version: "2.23.8"
type: report
authors:
- name: "tencentcloudbase"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/tencentcloudbase-web-development/audits/2"
identifiers:
- type: other
value: "skillstore:tencentcloudbase-web-development:audit:2"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
100
Maintainability
87
Content
65
Community
100
Spec Compliance
What You Can Build
Repair Web Flow Bugs
Find the owning route, component, or handler, then verify the user-visible flow in a browser.
Integrate CloudBase Web
Add CloudBase Web SDK usage while keeping browser and server boundaries clear.
Validate Release Readiness
Check build output, SPA routing, static hosting settings, and browser behavior before deployment.
Try These Prompts
Validate a Route Change
Use the web-development skill to inspect the existing app, identify the affected route, make the smallest fix, and report build and browser checks.
Add a Vite Page
Use the web-development skill to add a new Vite page within existing routing and component conventions. Include validation steps and remaining gaps.
Integrate CloudBase Auth
Use the web-development skill to review the current auth surface, keep browser SDK usage client-side, and route provider details to auth skills.
Prepare SPA Hosting
Use the web-development skill to prepare a React or Vue SPA for CloudBase static hosting. Verify routing mode, build output, and browser refresh behavior.
Best Practices
- Read existing route, service, and build conventions before changing code.
- Run project checks and browser flows that match the affected user journey.
- Keep CloudBase integration separate from unrelated UI or backend refactors.
Avoid
- Starting a redesign when the user asked for implementation or debugging.
- Claiming completion without build, lint, test, or browser evidence.
- Exposing sensitive credentials through public frontend environment variables.
Frequently Asked Questions
Does this skill create visual designs?
No. It directs agents to use a design skill before visual system work.
Which frameworks does it support?
It focuses on React, Vue, Vite, Next.js boundaries, and related browser workflows.
Can it deploy CloudBase static sites?
It provides deployment gates and static hosting guidance, but credentials and project setup are still required.
Does it run browser tests automatically?
It tells the agent when to use a browser validation tool and what evidence to collect.
Is it only for new apps?
No. It favors existing project patterns and targeted repairs in established applications.
How does it handle authentication?
It gives web boundary guidance and routes detailed provider work to companion auth skills.
Developer Details
Author
tencentcloudbaseLicense
MIT
Author version
v2.23.8
Skillstore revision
r1
Ref
24b2fe42a456262f3fd0fb3df72e12d9ed2c32ec
Maintenance freshness
7/18/2026
Usage
0 downloads · 0 views
File structure