eslint-security-scan

Scan JavaScript/TypeScript projects for security vulnerabilities using ESLint plugins.

17|5|Updated Feb 1, 2026

Search Tags:#typescript #security #javascript #eslint #static-analysis #code-review #vulnerability-detection

Ready to run

npx skills add https://github.com/alxayo/sec-check --skill eslint-security-scan

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: eslint-security-scan
Source: https://github.com/alxayo/sec-check/tree/main/.github/skills/eslint-security-scan
Command: npx skills add https://github.com/alxayo/sec-check --skill eslint-security-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

ESLint-based security scanning reduces the risk of insecure patterns in JavaScript/TypeScript code by combining ESLint with security plugins to detect dangerous patterns before deployment.

Core Features & Use Cases

Detects code injection, XSS, command injection, ReDoS, path traversal, prototype pollution, and weak crypto usage in JS/TS projects.
Triages code in web apps, Node.js services, and npm packages, and assists in malicious code review.
Works with React/Vue/Angular components and library code to enforce secure defaults.

Quick Start

Install ESLint with security plugins and run with a security-focused config to generate a report.

Frequently Asked Questions about eslint-security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect security vulnerabilities in JavaScript and TypeScript code?▼

Security vulnerabilities in JavaScript and TypeScript code are detected by combining ESLint with security plugins to identify dangerous patterns like code injection, XSS, and weak crypto prior to deployment.

What types of vulnerabilities can an ESLint security scan find?▼

ESLint security scanning detects code injection, XSS, command injection, ReDoS, path traversal, prototype pollution, and weak crypto usage in JS/TS projects.

Can I use ESLint security plugins to review React and Vue components?▼

ESLint security plugins work with React, Vue, and Angular components to enforce secure defaults and triage potentially malicious or risky code in web applications.

How do I run a static analysis security check on Node.js services?▼

Static analysis security checks on Node.js services run by configuring ESLint with eslint-plugin-security and eslint-plugin-no-unsanitized to generate a vulnerability report.

What do I need to set up security-focused static analysis for npm packages?▼

Security-focused static analysis for npm packages requires installing ESLint, security plugins like eslint-plugin-security, eslint-plugin-no-unsanitized, and @typescript-eslint, plus a security-focused configuration file.

Does ESLint security scanning work for malicious code review in npm packages?▼

ESLint security scanning assists malicious code review in npm packages by triaging risky code and detecting insecure patterns before deployment.