javascript-security

Apply JavaScript/TypeScript security best practices to prevent common vulnerabilities.

Updated Dec 15, 2025

Search Tags:#security #xss #javascript #csp #input-validation #code-review

Ready to run

npx skills add https://github.com/scruffydan/AI-Agents --skill javascript-security

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: javascript-security
Source: https://github.com/scruffydan/AI-Agents/tree/main/source/skills/javascript-security
Command: npx skills add https://github.com/scruffydan/AI-Agents --skill javascript-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill provides essential JavaScript/TypeScript security guidelines to prevent common web vulnerabilities, including unsafe DOM handling, insecure evaluation, and misconfigured security headers.

Core Features & Use Cases

Security patterns: recommended defenses for XSS, ReDoS, prototype pollution, and insecure eval usage.
Input handling & CSP: guidance on robust input validation, sanitization, and Content Security Policy hardening.
Code quality checks: linting rules, secure-by-default coding practices, and secure code review checklists for modern frameworks (React, Node).

Quick Start

Audit a JavaScript/TypeScript project for XSS risks, CSP misconfigurations, and unsafe input handling, and return a prioritized remediation plan.

Frequently Asked Questions about javascript-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent XSS vulnerabilities in JavaScript applications?▼

To prevent XSS in JavaScript applications, apply safe DOM manipulation techniques, robust input validation, and Content Security Policy hardening. This approach mitigates unsafe DOM handling and enforces secure-by-default coding practices across browser and server environments.

What is the best way to audit a TypeScript project for security risks?▼

The best way to audit a TypeScript project for security risks is to evaluate it against established JavaScript security best practices. This process identifies XSS risks, CSP misconfigurations, and unsafe input handling, returning a prioritized remediation plan.

How do I secure input validation and configure CSP for Node.js and React?▼

Securing input validation and configuring CSP for Node.js and React involves applying robust data sanitization patterns and implementing strict Content Security Policy headers. These defenses protect against injection attacks in modern frameworks.

Does this security guidance cover prototype pollution and ReDoS prevention?▼

Yes, this security guidance covers prototype pollution and ReDoS prevention. It provides recommended defenses, concrete linting rules, and resistant coding patterns to mitigate these specific vulnerabilities in JavaScript and TypeScript environments.

What are the limitations of using linting rules for JavaScript security?▼

Linting rules for JavaScript security enforce secure-by-default coding practices but cannot catch all runtime vulnerabilities. They must be combined with secure code review checklists and robust input validation to effectively prevent injection attacks.