frontend-mobile-security-xss-scan
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate security scanning logic for frontend frameworks (React, Vue, Angular). It includes code for a static analysis scanner that identifies dangerous patterns such as
innerHTML,dangerouslySetInnerHTML, and unsafe URL assignments. - [SAFE]: The instructions promote secure coding practices, recommending the use of
textContentinstead ofinnerHTMLand highlighting the importance of theDOMPurifylibrary for sanitization. - [SAFE]: The command execution examples (
npm install,eslint,semgrep) are standard developer workflows for security linting and static analysis, utilizing reputable open-source tools. - [INDIRECT_PROMPT_INJECTION]: The skill processes source code files for analysis, which is a potential ingestion point for indirect prompt injection. However, the skill is scoped to security analysis and does not possess capabilities (such as network exfiltration or file writing) that would elevate this concern beyond a baseline risk.
- Ingestion points: Reads JavaScript/TypeScript files using
fs.readFileinSKILL.md. - Boundary markers: None explicitly defined for file content.
- Capability inventory: Standard file read operations; no network or arbitrary execution capabilities present.
- Sanitization: Code performs regex-like string matching (
includes) for vulnerability detection.
Audit Metadata