Menu
检查 XSS、CSRF、原型污染等安全问题，支持 React/Vue/Angular
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.
Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
Archive multiple completed changes at once. Use when archiving several parallel changes.
Continue working on an OpenSpec change by creating the next artifact. Use when the user wants to progress their change, create the next artifact, or continue their workflow.
Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.
Fast-forward through OpenSpec artifact creation. Use when the user wants to quickly create all artifacts needed for implementation without stepping through each one individually.
| id | sec-js-check |
| name | JavaScript 安全审查 |
| category | security |
| description | 检查 XSS、CSRF、原型污染等安全问题，支持 React/Vue/Angular |
| tags | ["security","javascript","xss","csrf","frontend"] |
| updated_at | "2026-01-20T00:00:00.000Z" |
| allowed-tools | ["Read","Grep","Glob","Shell"] |
/js-security-check # 智能扫描 src 目录
/js-security-check file src/xxx.vue # 扫描指定文件
/js-security-check report # 生成详细报告
| 前缀 | 含义 | 处理方式 |
|---|---|---|
🔴 严重 | 可被直接利用 | 阻止发布 |
🟡 中等 | 需特定条件 | 尽快修复 |
⚪ 建议 | 最佳实践 | 可选优化 |
| 维度 | 检查项 |
|---|---|
| DOM 安全 | innerHTML、document.write、insertAdjacentHTML |
| URL 安全 | Open Redirect、javascript: scheme |
| 代码执行 | eval、new Function、setTimeout(string) |
| 原型污染 | proto、constructor、Object.assign |
| 存储安全 | localStorage 敏感信息、Cookie 属性 |
| 框架安全 | v-html、dangerouslySetInnerHTML |
| 资源 | URI |
|---|---|
| 完整检查清单 | skill://js-security-check/references/checklist.md |
| 修复示例 | skill://js-security-check/references/fix-examples.md |
| 评分标准 | skill://js-security-check/references/scoring-standard.md |
skill://js-security-check/references/checklist.mdskill://js-security-check/references/fix-examples.mdskill://js-security-check/references/report-format.mdskill://js-security-check/references/scoring-standard.mdskill://js-security-check/references/security-toolkit.md根据 SKILL.md 中的 IF-THEN 规则判断是否需要加载