원클릭으로 Manus에서 모든 스킬 실행

ui-secure-review

스타55

포크36

업데이트2026년 5월 6일 02:07

Review frontend and UI changes for concrete security risks such as XSS, unsafe URL handling, token leakage, missing origin checks, and client-side authorization gaps. Use when users ask for a UI code review focused on safety and reliability.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

LazyAGI

LazyAGI/LazyMind

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

UI Secure Review

Use this skill when the user asks for a frontend review with a security-first lens.

When to use

Reviewing PRs that touch UI rendering, routing, auth, storage, or API calls.
Auditing React, Vue, or plain JavaScript UI code for exploitable patterns.
Hardening existing UI code before release.

When not to use

Pure visual polish work with no logic or data handling changes.
Backend-only or infra-only changes.

Review workflow

Map changed files and rank risk by feature type.
Run quick pattern scans for dangerous APIs and sinks.
Read high-risk files in detail and trace data from input to render.
Confirm exploitability, impact, and realistic attack path.
Report findings ordered by severity with exact file and line references.
Suggest minimum safe fix and regression tests for each finding.

High-risk patterns to check

HTML injection: dangerouslySetInnerHTML, v-html, innerHTML, outerHTML.
Script execution: eval, new Function, string-based timers.
URL and navigation sinks: dynamic href, window.open, router redirects from untrusted params.
Tabnabbing risk: external links with target="_blank" missing rel="noopener noreferrer".
Token exposure: auth tokens in query params, logs, localStorage, or error traces.
Cross-origin trust: postMessage without strict origin and source checks.
Client-only authorization assumptions that can be bypassed in browser devtools.
Sensitive data persistence in cache, URL, or browser storage.

Quick scan commands

Use these patterns as a first pass, then manually verify context.

rg -n "dangerouslySetInnerHTML|v-html|innerHTML|outerHTML|eval\(|new Function\(" frontend/src
rg -n "window\.open|postMessage|target=\"_blank\"|localStorage|sessionStorage" frontend/src
rg -n "token|authorization|auth|redirect|location\.href|router\.push" frontend/src

Fix guidance

Prefer safe templating and escaped rendering over raw HTML insertion.
Validate and normalize all dynamic URLs before navigation.
Keep tokens in secure httpOnly cookies when architecture allows.
Add strict allowlists for cross-origin messaging and navigation targets.
Enforce authorization on the server even if UI hides actions.

Output contract

Findings first, ordered by severity.
Include file path, line, risk, exploit scenario, and concrete fix.
Explicitly say "No high-confidence findings" if nothing actionable is found.
Mention residual test gaps or assumptions.

이 저장소의 다른 Skills

같은 저장소

deep-research

LazyAGI/LazyMind

Use only when the user explicitly requests comprehensive multi-source research, such as "research X", "deep dive into X", "comprehensive review of X", "systematic comparison between X and Y", "investigate the landscape of X", or Chinese equivalents like "调研一下X", "深入研究X", "全面对比X与Y", "X的详细综述", "深度调查X". Do NOT trigger for simple questions, how-to guidance, ordinary recommendations, or content creation merely because research could improve the answer. Follow the source priorities supplied by the system and the user.

2026-07-1855

single-document-review

LazyAGI/LazyMind

Use this skill when the user requests to review, analyze, critique, or summarize a SINGLE academic paper, general document, internal report, proposal, or web article. Supports comprehensive structured reviews covering methodology/logic assessment, strengths, weaknesses, and constructive feedback. Retrieves content using native tools (`url_fetch`, `kb_search`, `arxiv_search`) and outputs the analysis directly in the chat.

2026-06-0555

systematic-document-and-literature-review

LazyAGI/LazyMind

Use this skill when the user wants a systematic review, thematic synthesis, or cross-document analysis across multiple academic papers OR provided general documents (reports, internal memos, web articles). Retrieves sources via arXiv, internal Knowledge Base (KB), or direct URLs. Analyzes the content within the current context and outputs a fully structured synthesis report directly in the chat.

2026-06-0555

paper-search

LazyAGI/LazyMind

Primary skill for searching, retrieving, and reading academic papers from arXiv.

2026-06-0555

sciverse-paper-search

LazyAGI/LazyMind

Use this skill for scientific literature search, evidence retrieval, paper metadata screening, and cited research synthesis with Sciverse. This LazyLLM-adapted version supports SciverseSearch search, meta_search, meta_catalog, and get_content only; it does not assume full Sciverse MCP resource or attachment APIs are available.

2026-06-0555

ui-resilient-accessibility

LazyAGI/LazyMind

Build and review UI components for robust accessibility and runtime resilience, including semantic structure, keyboard support, loading and error states, retry flows, and predictable async behavior.

2026-05-0655

name	ui-secure-review
description	Review frontend and UI changes for concrete security risks such as XSS, unsafe URL handling, token leakage, missing origin checks, and client-side authorization gaps. Use when users ask for a UI code review focused on safety and reliability.

UI Secure Review

Use this skill when the user asks for a frontend review with a security-first lens.

When to use

Reviewing PRs that touch UI rendering, routing, auth, storage, or API calls.
Auditing React, Vue, or plain JavaScript UI code for exploitable patterns.
Hardening existing UI code before release.

When not to use

Pure visual polish work with no logic or data handling changes.
Backend-only or infra-only changes.

Review workflow

Map changed files and rank risk by feature type.
Run quick pattern scans for dangerous APIs and sinks.
Read high-risk files in detail and trace data from input to render.
Confirm exploitability, impact, and realistic attack path.
Report findings ordered by severity with exact file and line references.
Suggest minimum safe fix and regression tests for each finding.

High-risk patterns to check

HTML injection: dangerouslySetInnerHTML, v-html, innerHTML, outerHTML.
Script execution: eval, new Function, string-based timers.
URL and navigation sinks: dynamic href, window.open, router redirects from untrusted params.
Tabnabbing risk: external links with target="_blank" missing rel="noopener noreferrer".
Token exposure: auth tokens in query params, logs, localStorage, or error traces.
Cross-origin trust: postMessage without strict origin and source checks.
Client-only authorization assumptions that can be bypassed in browser devtools.
Sensitive data persistence in cache, URL, or browser storage.

Quick scan commands

Use these patterns as a first pass, then manually verify context.

rg -n "dangerouslySetInnerHTML|v-html|innerHTML|outerHTML|eval\(|new Function\(" frontend/src
rg -n "window\.open|postMessage|target=\"_blank\"|localStorage|sessionStorage" frontend/src
rg -n "token|authorization|auth|redirect|location\.href|router\.push" frontend/src

Fix guidance

Prefer safe templating and escaped rendering over raw HTML insertion.
Validate and normalize all dynamic URLs before navigation.
Keep tokens in secure httpOnly cookies when architecture allows.
Add strict allowlists for cross-origin messaging and navigation targets.
Enforce authorization on the server even if UI hides actions.

Output contract

Findings first, ordered by severity.
Include file path, line, risk, exploit scenario, and concrete fix.
Explicitly say "No high-confidence findings" if nothing actionable is found.
Mention residual test gaps or assumptions.