javascript-sast

Name: javascript-sast
Availability: InStock
Author: vladkesler

Scan JavaScript and Node.js projects for security vulnerabilities via npm audit and source patterns.

39|6|Updated Feb 9, 2026

Search Tags:#security #vulnerability #javascript #nodejs #code-review #npm-audit #source-patterns

Ready to run

npx skills add https://github.com/vladkesler/initrunner --skill javascript-sast

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: javascript-sast
Source: https://github.com/vladkesler/initrunner/tree/main/examples/roles/security-scanner/skills/javascript-sast
Command: npx skills add https://github.com/vladkesler/initrunner --skill javascript-sast

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

JavaScript and Node.js projects often ship with hidden vulnerabilities. This skill automates detection of production advisories via npm audit and risky code patterns to improve security posture.

Core Features & Use Cases

Dependency audit: detects production vulnerabilities from npm audit
Source-pattern scan: flags risky constructs like eval, innerHTML usage, and potential prototype pollution
Use Case: integrate into CI to catch issues early or run locally during development

Quick Start

Run a quick security scan on a JS/Node project with npm audit and source-pattern checks.

Frequently Asked Questions about javascript-sast

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan a Node.js project for security vulnerabilities in dependencies?▼

To scan a Node.js project for security vulnerabilities, you can run automated checks that execute npm audit to detect production dependency advisories and report vulnerable modules.

What is source pattern scanning in JavaScript security?▼

Source pattern scanning in JavaScript security is the process of searching code for risky constructs like eval, innerHTML, and potential prototype pollution. It flags these risky code patterns to help improve your project's security posture.

Can I integrate JavaScript security scanning into my CI pipeline?▼

Yes, you can integrate JavaScript security scanning into your CI pipeline to catch issues early. The automated scanning runs npm audit for dependencies and source-pattern checks to detect vulnerabilities during continuous integration.

Does automated security scanning work with local development environments?▼

Yes, automated security scanning works with local development environments. You can run a quick security scan locally on your JavaScript or Node.js project to check both production dependencies and risky source patterns before committing code.

What risky JavaScript patterns should I look for during a code review?▼

During a JavaScript code review, you should look for risky constructs like eval usage, innerHTML assignments, and potential prototype pollution. Automated source-pattern scanning can flag these vulnerable paths in your codebase.