skills.rest
Q16G
Q16GCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

client-side-sec

Audit CSP configurations and DOM data flow risks in web projects.

83|8|Updated May 6, 2026
Search Tags:#security#xss#javascript#audit#csp#client-side#dom
One-click install
npx skills add https://github.com/Q16G/aster --skill client-side-sec
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: client-side-sec
Source: https://github.com/Q16G/aster/tree/main/skills/code-audit/client-side-sec
Command: npx skills add https://github.com/Q16G/aster --skill client-side-sec

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps teams systematically audit and enforce client-side security by validating CSP configurations and reviewing JavaScript data flows for common vulnerabilities in web applications.

Core Features & Use Cases

  • CSP policy auditing: verify script-src settings, nonce/hash usage, and potential unsafe configurations.
  • Client-side JS security auditing: analyze DOM interactions, postMessage usage, and token handling for exposure risks.
  • Use Case: For a web app with sensitive client data and complex CSP, generate a prioritized remediation plan and suggested CSP improvements.

Quick Start

Provide a target path to a web project and run automated CSP and client-JS security checks to generate a prioritized remediation report.

Frequently Asked Questions about client-side-sec

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit CSP configurations for script-src and nonce issues in a web project?▼

Audit CSP configurations by validating script-src settings, verifying nonce/hash usage, and detecting unsafe directives to generate clear remediation steps for your web project.

What is the best way to check JavaScript DOM interactions for XSS vulnerabilities?▼

Checking JavaScript DOM interactions involves analyzing DOM-driven data flow risks and postMessage usage to identify potential DOM-XSS vulnerabilities and token exposure.

How can I detect if tokens in localStorage are leaking data through client-side JavaScript?▼

Detect token leakage by analyzing client-side JavaScript data flows, specifically reviewing DOM manipulation and postMessage handling that could expose tokens stored in localStorage.

Can I use this to generate a remediation plan for frontend-heavy applications with complex CSP?▼

Yes, you can generate a prioritized remediation plan for frontend-heavy applications by evaluating complex CSP configurations and reviewing JavaScript logic for data exposure risks.

Does this client-side security audit work for projects without specific dependencies?▼

Yes, the client-side security audit operates without specific dependencies, analyzing your web project's CSP settings and JavaScript data flows directly to output a security report.

Related Skills

Explore More Software Engineering Skills→
dongitrandongitran
3

web-design-guidelines

Audit UI code against Web Interface Guidelines and output file:line findings.

Community
Basic
buiminhduc23011buiminhduc23011

awf-audit

Audit software projects for security, performance, and code quality issues.

Community
Advanced
d0whc3rd0whc3r

frontend-security-coder

Prevent XSS and improve DOM safety in client-side code.

Community
Advanced
lamb92009lamb92009

security-reviewer

Identify vulnerabilities in code, configurations, and infrastructure with prioritized remediation guidance.

Community
Advanced