菜单
Review frontend and UI changes for concrete security risks such as XSS, unsafe URL handling, token leakage, missing origin checks, and client-side authorization gaps. Use when users ask for a UI code review focused on safety and reliability.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use only when the user explicitly requests comprehensive multi-source research, such as "research X", "deep dive into X", "comprehensive review of X", "systematic comparison between X and Y", "investigate the landscape of X", or Chinese equivalents like "调研一下X", "深入研究X", "全面对比X与Y", "X的详细综述", "深度调查X". Do NOT trigger for simple questions, how-to guidance, ordinary recommendations, or content creation merely because research could improve the answer. Follow the source priorities supplied by the system and the user.
Use this skill when the user requests to review, analyze, critique, or summarize a SINGLE academic paper, general document, internal report, proposal, or web article. Supports comprehensive structured reviews covering methodology/logic assessment, strengths, weaknesses, and constructive feedback. Retrieves content using native tools (`url_fetch`, `kb_search`, `arxiv_search`) and outputs the analysis directly in the chat.
Use this skill when the user wants a systematic review, thematic synthesis, or cross-document analysis across multiple academic papers OR provided general documents (reports, internal memos, web articles). Retrieves sources via arXiv, internal Knowledge Base (KB), or direct URLs. Analyzes the content within the current context and outputs a fully structured synthesis report directly in the chat.
Primary skill for searching, retrieving, and reading academic papers from arXiv.
Use this skill for scientific literature search, evidence retrieval, paper metadata screening, and cited research synthesis with Sciverse. This LazyLLM-adapted version supports SciverseSearch search, meta_search, meta_catalog, and get_content only; it does not assume full Sciverse MCP resource or attachment APIs are available.
Build and review UI components for robust accessibility and runtime resilience, including semantic structure, keyboard support, loading and error states, retry flows, and predictable async behavior.
| name | ui-secure-review |
| description | Review frontend and UI changes for concrete security risks such as XSS, unsafe URL handling, token leakage, missing origin checks, and client-side authorization gaps. Use when users ask for a UI code review focused on safety and reliability. |
Use this skill when the user asks for a frontend review with a security-first lens.
dangerouslySetInnerHTML, v-html, innerHTML, outerHTML.eval, new Function, string-based timers.href, window.open, router redirects from untrusted params.target="_blank" missing rel="noopener noreferrer".postMessage without strict origin and source checks.Use these patterns as a first pass, then manually verify context.
rg -n "dangerouslySetInnerHTML|v-html|innerHTML|outerHTML|eval\(|new Function\(" frontend/src
rg -n "window\.open|postMessage|target=\"_blank\"|localStorage|sessionStorage" frontend/src
rg -n "token|authorization|auth|redirect|location\.href|router\.push" frontend/src