JavaScript Security

REFERENCE MODE: This skill provides reference material for JavaScript security review and hardening. Load specific standards on-demand based on current task. Do not load all standards at once.

Enforcement

Execution mode: Reference library; load standards on-demand for JavaScript security review and hardening tasks.

Prohibited actions:

• Do not assign untrusted data to innerHTML, outerHTML, or insertAdjacentHTML — these parse and execute injected markup
• Do not hand-roll HTML sanitization with regex; use a vetted allow-list sanitizer
• Do not render untrusted data into the DOM without choosing a text-treating sink or sanitizing first

Constraints:

• Untrusted data rendered into the DOM is an XSS trust boundary; the safe default is a text-treating sink (textContent, createElement + textContent)
• When rendering untrusted HTML is a genuine requirement, sanitize with a vetted library (DOMPurify) and prefer Trusted Types where the platform supports it
• DOMPurify is a third-party dependency — adding it is a user-approval step

When to Use This Skill