skills.rest
huseyindeniz
huseyindenizCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-audit

Analyze TypeScript/JavaScript source code for hardcoded secrets and unsafe patterns.

15|7|Updated Sep 11, 2023
Search Tags:#security#xss#secrets#vulnerabilities#eval#env-variables
One-click install
npx skills add https://github.com/huseyindeniz/vite-react-dapp-template --skill security-audit-huseyindeniz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/huseyindeniz/vite-react-dapp-template/tree/main/.claude/skills/security-audit
Command: npx skills add https://github.com/huseyindeniz/vite-react-dapp-template --skill security-audit-huseyindeniz

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill analyzes security vulnerabilities in your codebase, focusing on hardcoded secrets, unsafe eval usage, risky HTML patterns, and environment variable exposure.

Core Features & Use Cases

  • Hardcoded Secrets Check: Detects hardcoded API keys, passwords, and tokens.
  • Eval Usage Check: Flags dangerous eval usage and unsafe dynamic code.
  • Dangerous HTML Patterns Check: Warns against direct innerHTML and dangerouslySetInnerHTML.
  • Environment Variable Exposure Check: Ensures only VITE_ prefixed variables are exposed to client code.

Quick Start

Run all security checks to surface vulnerabilities and generate a report: node ./.claude/skills/security-audit/scripts/run_all_checks.mjs

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect hardcoded secrets in my codebase?▼

Hardcoded secrets detection scans source code for API keys, passwords, and tokens embedded directly in files. This Skill identifies these vulnerabilities with file paths and line numbers, helping you remove exposed credentials before deployment or code review.

Can I check for dangerous eval usage in JavaScript and TypeScript?▼

Yes, the Skill flags eval() calls and unsafe dynamic code execution patterns in TypeScript and JavaScript codebases. It reports violations with locations so you can refactor unsafe patterns to safer alternatives.

What security risks does innerHTML and dangerouslySetInnerHTML create?▼

Direct innerHTML and dangerouslySetInnerHTML patterns expose code to XSS attacks by rendering unsanitized HTML. This Skill detects these dangerous patterns in your codebase and reports them for remediation.

How do I ensure environment variables aren't exposed to client code?▼

Environment variable exposure checks verify that only VITE_ prefixed variables leak to client-side bundles. The Skill scans for improper exposure across frontend and backend projects and generates violation reports.

Can I run security checks in CI pipelines and generate reports?▼

Yes, the Skill supports batch runs across entire codebases and optional markdown report generation. You can integrate it into CI pipelines to automate security scanning on every commit or pull request.

Does this work with both frontend and backend projects?▼

The Skill applies to TypeScript and JavaScript across frontend and backend contexts. It detects secrets, eval usage, XSS patterns, and environment exposure in any codebase structure.

Related Skills

Explore More Software Engineering Skills→
rochaluiz8888rochaluiz8888

style-guide

Detect Google style violations across Python, TypeScript, JavaScript, and HTML/CSS files.

Community
Advanced
BenjamindaosonBenjamindaoson

code-review-expert

Analyze git changes for SOLID violations, security risks, and quality issues.

Community
Advanced
adaptive-enforcement-labadaptive-enforcement-lab
3

secure

Scan code, dependencies, and containers for vulnerabilities and generate SBOMs.

Official
Advanced
thisisqubikathisisqubika

security-review

Analyze code repositories for vulnerabilities using SAST and AI triage.

Official
Advanced