Frontend & Mobile Security
XSS, CSP and mobile storage security handled by three agents plus a sink-pattern scanner.
Install
Claude Code: /plugin marketplace add wshobson/agents → /plugin install frontend-mobile-security@claude-code-workflows
Kullanıcı girdisini DOM'a basarken, CSP kurarken ya da mobil uygulamada gizli veriyi saklarken
- Author
- wshobson
- License
- MIT
Three agents split the client side: a frontend developer, a frontend security coder and a mobile security coder. The xss-scan command is the concrete part. It walks React, Vue, Angular and plain JavaScript files looking for the sink patterns that actually cause injection, among them innerHTML, outerHTML, insertAdjacentHTML, document.write and unvalidated location.href or window.open, then reports each hit with a severity, a CWE reference and a fix. The CSP guidance is staged rather than all-or-nothing: report-only first, then nonce or hash sources, then strict-dynamic. On mobile the weight shifts to WebView URL allowlisting, JavaScript disabled by default, and Keychain or Keystore instead of plain local storage.
Similar skills
Security Guidance
SkillSecurity review of agent-written code at three points: on edit, on stop, and at commit.
Frontend & Mobile Development
SkillSeparates React state into five kinds so fetched server data never lands in a global store.
AWS Agents for DevSecOps
SkillRoutes incident, release-readiness, scan and pentest work to the AWS DevOps and Security agents.
Comments(0)
Sign in to comment