Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
DeepSeek
Muse+22 moreClaude CodeCursorCodex CLIDeepSeekMuse
Dots
Manus
Grok
Grok Bot+18 agentsWebSecurityGuard — Stop AI Shipping XSS and Leaked Secrets
Blocks dangerouslySetInnerHTML, exposed NEXT_PUBLIC_ keys, and weak client-side route guards.
$5
WebSecurityGuard — Stop AI Shipping XSS and Leaked Secrets
Example session with this skill installed
Audit this React component for XSS.
import React from "react";
export function Comment({ text }) {
return <div dangerouslySetInnerHTML={{ __html: text }} />;
}
- Read your context and instructions
- Compiled the websecurityguard
- Generated the UI component
WebSecurityGuard Audit Report
- Audit Status: BLOCKED. Critical frontend vulnerability isolated.
- Framework Detected: React
- Target File: app/components/Comment.tsx
- Total Findings: 1 critical fault identified.
Verified Output (Console Protocol)
--- INPUT (React component rendering user input as raw HTML) ---
import React from "react";
export function Comment({ text }) {
return <div dangerouslySetInnerHTML={{ __html: text }} />;
}
--- WEB SECURITY GUARD AUDIT ---
Framework: react
File: app/components/Comment.tsx
findings: 1
[ERR_XSS_SINK] line 4 — dangerouslySetInnerHTML
Detail: user input rendered as raw HTML
Action: sanitize with DOMPurify before rendering
audit_status: BLOCKED
Security Audit Breakdown
XSS Sink Interception (ERR_XSS_SINK): Flagged a hazardous raw HTML rendering layout at line 4. The engine isolated a dangerouslySetInnerHTML node consuming unverified dynamic parameters directly within the React layout interface.
2.
Remediation Vector: Blocked code migration to prevent potential cross-site scripting executions, requesting immediate integration of validation layers (e.g., sanitizing input with DOMPurify before DOM injection).
3.
Air-Gapped Privacy: Evaluated the complete frontend abstract syntax tree (AST) structure 100% offline in local memory buffers, ensuring no internal source fragments were transmitted to cloud services.
Comment.tsx
TSX · React component
Example file from a real run - the skill writes it into your workspace.
Connects securely to your tools. The creator never sees your data.
About this skill
Stop letting AI agents ship insecure frontend components. When autonomous assistants generate UI code, they frequently opt for lazy shortcuts: rendering raw user input through dangerouslySetInnerHTML (opening severe XSS holes), storing live API keys inside leaky frontend environment variables like NEXT_PUBLIC_, or enforcing access control only in the browser while leaving the backend endpoint completely unprotected.
WebSecurityGuard acts as an inline static validation gate for modern frontend workflows. It deep-scans your React, Next.js, Vue, and Svelte component layers using Abstract Syntax Tree (AST) analysis, programmatically flagging critical client-side security regressions before they ever get deployed to production.
By catching frontend flaws early at the compilation layer, this skill guarantees that your client-facing code remains secure without slowing down your automated multi-agent development velocity.
What it does
- XSS Vulnerability Interception: Instantly flags and isolates hazardous raw html rendering modules like React's
dangerouslySetInnerHTMLor Vue'sv-htmlgenerated by unchecked AI. - Frontend Secret Audit: Detects high-entropy access tokens, webhooks, and private API keys accidentally leaked inside client-exposed framework variables.
- Client-Side Bypass Mitigation: Identifies weak UI routing configurations that mock role-based access control exclusively in the browser layer without proper authorization hooks.
- 100% Offline Static Analysis: Evaluates your frontend component structures entirely inside secure local memory buffers with absolute zero external network overhead.
Technical Specifications
- Multi-Framework Evaluation: Fully calibrated to map syntax layouts across modern web frameworks including React, Next.js, Vue, and Svelte.
- Passive Read-Only Configuration: Functions independently without modifying your active repository files, altering directory paths, or deploying local execution engines.
Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Security.
Advisory only — does not execute code or fetch URLs. Client-only auth confirmed only when the Static and layout constraints only. Measures frontend abstract syntax trees and component properties inside local memory configurations without running active build engines, deploying runtime browsers, or mutating source files directly. Client-only authorization checks require both client and API route definitions within the scanned context for absolute verdict anchoring. Isolated UI nodes under 10 total lines of code volume may be bypassed to prevent incomplete token verification tracks.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before buying a skill.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 23 days ago
- Software
Python
Permissions
File Scopes
Read-only sandbox access to frontend component structures and environment parameters. Programmatically evaluates client-side layouts completely offline inside secure memory allocations, with absolute zero permission for outbound network queries, file mutations, or active workspace writes.