fec-security-review

Identify and report frontend security risks with graded findings and actionable fixes.

21|3|Updated Mar 17, 2026

Search Tags:#security #frontend #xss #csp #risk-assessment #csrf

Ready to run

npx skills add https://github.com/bovinphang/frontend-craft --skill fec-security-review

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: fec-security-review
Source: https://github.com/bovinphang/frontend-craft/tree/main/localized/zh-CN/skills/fec-security-review
Command: npx skills add https://github.com/bovinphang/frontend-craft --skill fec-security-review

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

识别前端代码中的客户端安全风险，并给出可执行修复建议。

Core Features & Use Cases

对 XSS、CSRF、敏感数据暴露、不安全 DOM API、不可信用户输入、认证/token 处理、依赖风险或第三方脚本等前端威胁进行系统化审查与分级。
提供可执行的修复建议和安全边界考虑，支持生成安全审查报告模板。
适用于 SPA、渲染组件、表单上传、第三方脚本加载等场景。

Quick Start

请在你的代码库中运行安全审查流程，AI 将输出分级报告并保存到报告路径。

Frequently Asked Questions about fec-security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my frontend codebase for XSS and CSRF vulnerabilities?▼

To scan a frontend codebase for XSS and CSRF risks, run a guided security review process that identifies client-side threats and outputs graded findings with actionable fixes saved to a timestamped report file.

What is the best way to identify insecure DOM API usage and untrusted user input in a SPA?▼

Identifying insecure DOM API usage in a SPA requires a systematic frontend security review that detects untrusted user input processing, assigns risk grades from CRITICAL to LOW, and provides executable remediation steps.

Does this frontend security review cover authentication flows and third-party script integrations?▼

Yes, frontend security review covers authentication flows, token handling, and third-party script integration risks, systematically assessing these areas alongside dynamic HTML processing and file upload vulnerabilities.

How are security findings reported and formatted after a codebase review?▼

Security findings are reported as graded risk assessments ranging from CRITICAL to LOW, complete with specific file references and actionable fixes, aligning with a standard report template and saved to a timestamped file.

Can I assess sensitive data exposure risks during dynamic HTML processing and file uploads?▼

Yes, you can assess sensitive data exposure risks by reviewing dynamic HTML processing, file uploads, and redirects, which generates graded security findings and actionable fixes for your frontend stack.