bk-monitor-security-audit

Audit frontend code for XSS by checking all DOM injection points such as innerHTML and v-html bindings, verifying user input is sanitized before rendering, and reviewing URL and redirect handling. This Skill walks through each checkpoint systematically and reports findings.

A frontend security review checks DOM manipulation safety, URL and redirect validation, postMessage cross-origin communication, dynamic code execution via eval, sensitive information exposure, prototype pollution, and ReDoS patterns in regular expressions.

Run an audit during code submission or review, when changes involve DOM operations, URL processing, or user input handling, and whenever XSS, CSRF, or injection concerns are raised about the codebase.

Yes, the audit checklist covers CSRF risks, injection patterns, open redirects, unsafe postMessage usage, eval-based dynamic execution, prototype pollution, and ReDoS in addition to XSS vectors like innerHTML and v-html.

A static audit inspects source code patterns and cannot observe runtime behavior, so it may miss vulnerabilities that only appear through specific data flows or server-side interactions. Combine it with dynamic testing for full coverage.