Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

JavaScript 安全审查 — measured AI agent skill | DecimalAI

tencentblueking/JavaScript 安全审查

NewSkillScoreMaintained

检查 XSS、CSRF、原型污染等安全问题，支持 React/Vue/Angular

Securityby tencentblueking

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/tencentblueking-javascript/SKILL.md

decimalai skills pull tencentblueking-javascript --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/tencentblueking-javascript/SKILL.md https://app.decimal.ai/s/tencentblueking-javascript/SKILL.md

Raw file: /s/tencentblueking-javascript/SKILL.md ↗ · machine-readable summary at /s/tencentblueking-javascript.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 3h ago

—+7% tokens0% turns82% of whole cases pass with skill (18/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-05	✗→✓	▲ Improved	9%	0%
case-06	✗→✓	▲ Improved	-19%	0%
case-10	✗→✓	▲ Improved	-29%	0%
case-11	✗→✓	▲ Improved	-50%	0%
case-14	✗→✓	▲ Improved	26%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

tencentblueking / bk-bcs

bcs-services/bcs-project-manager/.cursor/skills/js-security-check/SKILL.md

View on GitHub ↗

License NOASSERTIONImported 8/3/2026Version v1

Skill contents

SKILL.md

JavaScript 安全审查

⚠️ 核心规则

永不信任用户输入 - 所有用户数据需校验和转义
默认安全 - 使用安全 API（textContent 而非 innerHTML）
纵深防御 - 多层安全措施，不依赖单一防护

快速开始

bash
/js-security-check                    # 智能扫描 src 目录
/js-security-check file src/xxx.vue   # 扫描指定文件
/js-security-check report             # 生成详细报告

问题分级

| 前缀 | 含义 | 处理方式 | |------|------|----------| | 🔴 严重 | 可被直接利用 | 阻止发布 | | 🟡 中等 | 需特定条件 | 尽快修复 | | ⚪ 建议 | 最佳实践 | 可选优化 |

检查维度

| 维度 | 检查项 | |------|--------| | DOM 安全 | innerHTML、document.write、insertAdjacentHTML | | URL 安全 | Open Redirect、javascript: scheme | | 代码执行 | eval、new Function、setTimeout(string) | | 原型污染 | __proto__、constructor、Object.assign | | 存储安全 | localStorage 敏感信息、Cookie 属性 | | 框架安全 | v-html、dangerouslySetInnerHTML |

📦 按需加载资源

| 资源 | URI | |-----|-----| | 完整检查清单 | skill://js-security-check/references/checklist.md | | 修复示例 | skill://js-security-check/references/fix-examples.md | | 评分标准 | skill://js-security-check/references/scoring-standard.md |

📦 可用资源

skill://js-security-check/references/checklist.md
skill://js-security-check/references/fix-examples.md
skill://js-security-check/references/report-format.md
skill://js-security-check/references/scoring-standard.md
skill://js-security-check/references/security-toolkit.md

> 根据 SKILL.md 中的 IF-THEN 规则判断是否需要加载

Want to see if tencentblueking/JavaScript 安全审查 would activate on your phrasing? Try it before you install — no LLM call, no signup.

Other measured skills in the registry, with their headline benchmark lift.