security-review-criteria
Installation
SKILL.md
Trust Boundaries
The following are considered trusted:
- Environment variables
- CLI flags and arguments
- Configuration files in repository
Modern frameworks (React, Angular, Vue) are considered XSS-safe unless:
- dangerouslySetInnerHTML or equivalent is used
- innerHTML is directly manipulated
- eval() or Function() is used with user input