Audit frontend codebases for security vulnerabilities and bad practices. Use when performing security reviews, auditing code for XSS/CSRF/DOM vulnerabilities, checking Content Security Policy configurations, validating input handling, reviewing file upload security, or examining Node.js/NPM dependen

Frontend Security Audit Skill Perform comprehensive security audits of frontend codebases to identify vulnerabilities, bad practices, and missing protections. Audit Process 1. Scan for dangerous patterns Search codebase for known vulnerability indicators 2. Review framework specific risks Check for framework security bypass patterns 3. Validate defensive measures Verify CSP, CSRF tokens, input validation 4. Check dependencies Review npm/node dependencies for vulnerabilities 5. Report findings Categorize by severity with remediation guidance Critical Vulnerability Patterns to Search XSS Indicators (Search Priority: HIGH) CSRF Indicators Sensitive Data Exposure Reference Documentation Load these references based on findings: XSS vulnerabilities found : See references/xss prevention.md CSRF concerns : See references/csrf protection.md DOM manipulation issues : See references/dom security.md CSP review needed : See references/csp configuration.md Input handling issues : See references/input validation.md Node.js/NPM audit : See references/nodejs npm security.md Framework specific patterns : See references/framework patterns.md File upload handling : See references/file upload security.md JWT implementation : See references/jwt security.md Severity Classification CRITICAL Exploitable XSS, authentication bypass, secrets exposure HIGH Missing CSRF protection, unsafe DOM manipulation, SQL injection vectors MEDIUM Weak CSP, missing security headers, improper input validation LOW Informational disclosure, deprecated functions, suboptimal practices Report Format OWASP Reference Links For comprehensive guidance, consult these OWASP cheatsheets directly: XSS Prevention: https://cheatsheetseries.owasp.org/cheatsheets/Cross Site Scripting Prevention Cheat Sheet.html DOM XSS Prevention: https://cheatsheetseries.owasp.org/cheatsheets/DOM based XSS Prevention Cheat Sheet.html CSRF Prevention: https://cheatsheetseries.owasp.org/cheatsheets/Cross Site Request Forgery Prevention Cheat Sheet.html CSP: https://cheatsheetseries.owasp.org/cheatsheets/Content Security Policy Cheat Sheet.html Input Validation: https://cheatsheetseries.owasp.org/cheatsheets/Input Validation Cheat Sheet.html HTML5 Security: https://cheatsheetseries.owasp.org/cheatsheets/HTML5 Security Cheat Sheet.html DOM Clobbering: https://cheatsheetseries.owasp.org/cheatsheets/DOM Clobbering Prevention Cheat Sheet.html Node.js Security: https://cheatsheetseries.owasp.org/cheatsheets/Nodejs Security Cheat Sheet.html NPM Security: https://cheatsheetseries.owasp.org/cheatsheets/NPM Security Cheat Sheet.html AJAX Security: https://cheatsheetseries.owasp.org/cheatsheets/AJAX Security Cheat Sheet.html File Upload: https://cheatsheetseries.owasp.org/cheatsheets/File Upload Cheat Sheet.html Error Handling: https://cheatsheetseries.owasp.org/cheatsheets/Error Handling Cheat Sheet.html JWT Security: https://cheatsheetseries.owasp.org/cheatsheets/JSON Web Token for Java Cheat Sheet.html User Privacy: https://cheatsheetseries.owasp.org/cheatsheets/User Privacy Protection Cheat Sheet.html gRPC Security: https://cheatsheetseries.owasp.org/cheatsheets/gRPC Security Cheat Sheet.html

frontend-security