What problem does it solve? Cross-Site Scripting (XSS) vulnerabilities hide in everyday frontend patterns like innerHTML assignments, React's dangerouslySetInnerHTML, and Vue's v-html directive, and manual code review often misses them. This Skill scans client-side code for unsafe DOM manipulation, URL injection, and unsanitized rendering, then reports each finding with severity, CWE reference, and a concrete fix. ## Core Features & Use Cases - Static XSS Detection: Scans JavaScript and TypeScript files for dangerous patterns such as innerHTML, document.write, insertAdjacentHTML, and unsafe location.href assignments involving user-controlled data. - Framework-Specific Analysis: Detects React's dangerouslySetInnerHTML without DOMPurify sanitization and Vue's v-html directive, with guidance for Angular's built-in sanitization. - Actionable Reports: Groups findings by severity (critical, high, medium, low) with file, line number, vulnerable code, fix recommendation, and CWE-79 mapping. - Use Case: Before shipping a React feature that renders user-submitted comments, run the scan to catch any unsanitized dangerouslySetInnerHTML usage and receive the exact DOMPurify.sanitize() pattern to apply. ## Quick Start Scan the src directory of my React project for XSS vulnerabilities and generate a severity-grouped report with fix recommendations.
