An automated security auditor for frontend codebases that detects vulnerabilities like XSS, CSRF, and sensitive data exposure.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install frontend-security-review
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install frontend-security-review using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Frontend Security Review?
The Frontend Security Review skill is a specialized tool for AI coding agents designed to perform deep security analysis on modern web applications. It proactively scans for common vulnerabilities including Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and insecure handling of sensitive data such as API keys or authentication tokens. By utilizing this skill within the Openclaw Skills ecosystem, developers can ensure their React, Vue, or vanilla JavaScript projects adhere to strict security standards.
The skill not only identifies risks but also provides actionable remediation advice and generates structured reports. It acts as an automated security gatekeeper, ensuring that sensitive operations like payments, file uploads, and authentication logic are thoroughly vetted before deployment.
Frontend Security Review Use Cases
- Auditing code that handles user input, form submissions, or file uploads to prevent injection attacks.
- Reviewing authentication and authorization logic, including JWT and token management.
- Scanning for hardcoded secrets, API keys, or sensitive data stored in local storage.
- Performing pre-deployment security checks and reviewing Pull Requests for high-risk changes.
- Validating third-party script integrations and dynamic content rendering for potential vulnerabilities.
How Frontend Security Review Works
- The skill is triggered automatically when the agent detects sensitive operations or upon manual request for a security audit.
- It scans the source code for insecure patterns like dangerouslySetInnerHTML or v-html that lack proper sanitization.
- The agent evaluates data storage practices to ensure tokens are handled via httpOnly cookies rather than local storage.
- It performs dependency audits and checks for CSRF tokens on all state-changing requests (POST, PUT, DELETE).
- It validates that all user inputs are sanitized using libraries like DOMPurify and that URLs are protocol-checked.
- A comprehensive Markdown report is generated, categorizing findings by severity (High, Medium, Low).
- The report is saved to a designated reports directory with a timestamped filename for historical tracking.
Frontend Security Review Setup
To enable this skill within your AI agent environment, ensure the Openclaw Skills framework is configured. You can invoke the security review directly through your agent interface.
# Example of triggering a security scan via the CLI
openclaw run security-review --target ./src
# Ensure dependencies for audit are installed
npm install
Frontend Security Review Data Schema & Taxonomy
The skill organizes its findings into a structured Markdown report located in the project root.
| Attribute | Details |
|---|---|
| Directory | /reports/ |
| Filename | security-review-YYYY-MM-DD-HHmmss.md |
| Severity Levels | High (Red), Medium (Yellow), Low/Advice (Blue) |
| Report Content | Timestamp, Tool version, File/Line references, Fix suggestions, and Overall Security Rating |
Frontend Security Review Advanced Features
- Integration with npm audit and OWASP checklists for industry-standard compliance.
- Specialized sub-agent delegation to the frontend-security-reviewer for deep threat modeling.
- Automated Grep patterns to identify high-risk DOM and API usage across large codebases.
- Subresource Integrity (SRI) validation for dynamically loaded third-party scripts.
- Blocking mechanism that flags high-severity issues as PR-blockers to prevent insecure merges.
SKILL.md
Loading
Related Openclaw Skills
Four-Layer Memory
A sophisticated four-tier memory architecture designed to manage AI persona, task context, and long-term knowledge without overwhelming context windows.
Test and Fix
An automated validation and repair tool that executes project checks, diagnoses failures, and performs surgical code fixes.
Vue 3 Project Standard
A professional-grade engineering specification for Vue 3 and TypeScript projects, ensuring scalable architecture and enterprise coding standards.
Lossless Claw
Lossless Claw is a local memory distillation tool that transforms raw conversation logs into structured, long-term knowledge while preserving traceability.
File Archive System
A local file-based archiving system designed to structure AI memory, logs, and knowledge into a searchable four-layer directory.
Programmer Cognition
A professional-grade cognitive framework for AI agents to perform systematic code reviews, structured debugging, and deployment safety checks.
Featured*
