security-review-owasp-third-party-javascript-management

Reviewing third-party JavaScript security risks involves evaluating script loading, DOM sinks, browser policies, and cross-origin behavior to identify injection or data leakage paths. This Skill inspects widgets and dependencies for unsafe loading, excessive privilege, and supply-chain exposure.

Browser boundary analysis covers DOM sinks, storage, messaging, framing, and cross-origin behavior. It evaluates client-side state and trust boundaries to detect injection risks and data leakage paths during security reviews of browser-rendered pages and response policies.

Checking CSP and cross-origin framing requires evidence-based assessment of browser policies, DOM sinks, and third-party dependencies. This Skill separates confirmed findings from review gaps, evaluating script loading and messaging behavior against OWASP Third-Party JavaScript Management guidance.

Yes, assessing supply-chain exposure from external scripts is a core function. The Skill inspects third-party scripts and browser integrations for unsafe loading and excessive privilege, producing passed checks and an overall assessment tailored to OWASP guidelines.

Documenting DOM injection and data leakage findings requires separating confirmed evidence from review gaps. This Skill outputs structured findings, passed checks, and a concise overall assessment based on evaluated trust boundaries and leakage paths.

Separating confirmed findings from gaps ensures an evidence-based assessment of DOM sinks, browser policies, and trust boundaries. This distinction prevents false positives in script trust reviews and clarifies which third-party dependency risks still require further evaluation.