schalkneethling Frontend Security Audit Skill
Audit frontend-adjacent code by mapping trust boundaries, tracing untrusted data into dangerous sinks, and using searches as supporting evidence. Cover browser/frontend concerns first, then route related server, package, authentication, and upload findings to the relevant reference.
Workflow
- Map routes, rendering models, APIs, authentication/session boundaries, third-party scripts, uploads, package-manager entry points, and deployment assumptions.
- List untrusted sources such as URL parameters, forms, storage,
postMessage, responses, files, cookies, headers, and package metadata. Trace them to DOM, navigation, command, filesystem, database, network, and log sinks. - Load
references/audit-workflow.mdfor focused evidence searches. Treat matches as leads, not proof; use AST-aware tooling where syntax or multiline structure matters. - Review output encoding, sanitization, CSP, CSRF, token storage, input validation, uploads, dependencies, and framework escape hatches.
- Rate the confirmed finding from exploitability, impact, reachability, required privileges, user interaction, data sensitivity, and compensating controls.
- Report the affected trust boundary, evidence, exploit scenario, severity rationale, remediation,
and authoritative reference using the template in
references/audit-workflow.md.
Reference Routing
| Finding area | Load |
|---|---|
| Browser XSS, unsafe URLs, tabnabbing, HTML injection | references/xss-prevention.md |
| DOM sinks, clobbering, postMessage, client storage | references/dom-security.md |
| CSP headers, nonces, hashes, Trusted Types | references/csp-configuration.md |
| Cookie auth, forms, state-changing requests | references/csrf-protection.md |
| URL, number, date, schema, and path validation | references/input-validation.md |
| React, Astro, Twig, SSR, hydration, templates | references/framework-patterns.md |
| Uploads, downloads, archives, quarantine | references/file-upload-security.md |
| JWT lifecycle, storage, fingerprints, refresh flows | references/jwt-security.md |
| Node runtime, npm supply chain, scripts, command execution | references/nodejs-npm-security.md |
Name boundaries precisely, for example “browser-to-API CSRF,” “frontend-triggered upload processing,” or “package-script supply-chain risk.” State scope limits: route deep backend authorization, database, infrastructure, malware, and incident-response work to specialists.
Severity
- Critical: likely high-impact exploit such as unauthenticated account takeover, privileged stored XSS, production credential exposure, or reachable remote code execution.
- High: plausible exploit with meaningful user, data, integrity, or supply-chain impact.
- Medium: real weakness with limited reach, prerequisites, lower sensitivity, or meaningful compensating controls.
- Low: hard-to-exploit or defense-in-depth gap, deprecated pattern, or hygiene issue.
Always record why the project-specific evidence supports the chosen severity. Consider attacker capability, interaction, privileges, production reachability, persistence, blast radius, and existing controls. Do not assign severity from a search result alone.