web-utilities-native-js-68d79b — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited web-utilities-native-js-68d79b (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Quick Guide: Prefer native JavaScript (ES2022-ES2025) over utility libraries. UsestructuredClonefor deep cloning,Object.groupByfor grouping, ES2023 immutable array methods (toSorted,toReversed,with), and ES2025 Set methods for set operations. Only reach for utility libraries when native alternatives genuinely don't exist or lack needed features (cancel/flush on debounce, deep merge with array strategies).
<critical_requirements>
All code must follow project conventions in CLAUDE.md (kebab-case, named exports, import ordering, import type, named constants)(You MUST use native ES2022+ methods before considering utility libraries - check this skill first)
(You MUST use immutable array methods (`toSorted`, `toReversed`, `toSpliced`, `with`) instead of mutating methods)
(You MUST use `structuredClone` for deep cloning - NOT JSON.parse/JSON.stringify hacks)
(You MUST define named constants for all numeric values - NO magic numbers in utility functions)
</critical_requirements>
Auto-detection: native JavaScript utilities, lodash alternative, ES2023 array methods, toSorted, toReversed, structuredClone, Object.groupBy, Set union, Set intersection, optional chaining, nullish coalescing, at(), findLast
When to use:
When NOT to use:
structuredClone cannot clone functionsKey patterns covered:
_.get)toSorted, toReversed, toSpliced, with)structuredClone (handles Map, Set, Date, circular refs)Object.groupBy / Map.groupBy (ES2024 - replaces reduce-based grouping)Detailed Resources:
<philosophy>
Modern JavaScript (ES2022-ES2025) provides native alternatives for ~80% of common utility library functions. Using native methods means:
Key principle: Check native JavaScript first. Only use utility libraries for genuinely missing functionality.
// Native is free - no imports needed
const unique = [...new Set(items)];
const last = items.at(-1);
const sorted = items.toSorted((a, b) => a.name.localeCompare(b.name));
const cloned = structuredClone(complexObject);
const grouped = Object.groupBy(items, (item) => item.category);ES Version Reference:
| Feature | ES Version | Browser Support |
|---|---|---|
Optional chaining (?.) | ES2020 | All modern browsers |
Nullish coalescing (??) | ES2020 | All modern browsers |
at() negative indexing | ES2022 | All modern browsers |
toSorted, toReversed, with | ES2023 | All modern browsers |
Object.groupBy, Map.groupBy | ES2024 | Chrome 117+, Safari 17.4+ |
| Set methods (union, etc.) | ES2025 | Chrome 122+, Safari 17+ |
</philosophy>
<patterns>
Optional chaining + nullish coalescing replaces _.get with zero bundle cost.
const DEFAULT_CITY = "Unknown";
const city = user?.address?.city ?? DEFAULT_CITY;
const result = service?.logger?.log?.("message"); // method call
const first = data?.items?.[0]?.name ?? "No items"; // array accessWhy this matters: Handles null/undefined gracefully, type-safe with TypeScript, no runtime cost.
See examples/core.md for full patterns.
Always use immutable variants - critical for reactive frameworks and shared state.
const sorted = items.toSorted((a, b) => a.price - b.price); // not .sort()
const reversed = items.toReversed(); // not .reverse()
const updated = items.with(1, newItem); // not items[1] = x
const removed = items.toSpliced(1, 1); // not .splice()Why this matters: Mutating methods cause bugs in shared state and reactive frameworks that rely on reference equality to detect changes.
See examples/core.md for immutable update patterns.
Replaces JSON round-trip and lodash _.cloneDeep. Handles types JSON cannot.
const cloned = structuredClone(complexObject);
// Preserves: Date, Map, Set, RegExp, ArrayBuffer, circular references
// Cannot clone: functions, DOM nodes, Error objects with custom propertiesWhy this matters: JSON.parse(JSON.stringify()) silently corrupts Date (becomes string), Map/Set (becomes {}), and loses undefined.
See examples/core.md for cloning patterns.
Replaces verbose reduce-based grouping and lodash _.groupBy.
const byCategory = Object.groupBy(products, (p) => p.category);
const THRESHOLD = 100;
const byRange = Object.groupBy(items, (item) =>
item.price >= THRESHOLD ? "expensive" : "affordable",
);
// Returns null-prototype object - use Object.hasOwn() not hasOwnPropertyWhy this matters: Reduce-based grouping is verbose, error-prone (forgetting key init), and has prototype pollution risk with {}.
See examples/arrays.md for grouping patterns.
Native set operations replace manual filter-based implementations.
const union = setA.union(setB);
const common = setA.intersection(setB);
const diff = setA.difference(setB);
const either = setA.symmetricDifference(setB);
const isSub = setA.isSubsetOf(setB);
// Returns Set - spread to array if needed: [...setA.union(setB)]Why this matters: Filter + includes/indexOf is O(n^2). Native Set methods are O(n).
See examples/arrays.md for set operations and pre-ES2025 fallbacks.
findLast and findLastIndex replace reverse-then-find anti-pattern.
const lastError = logs.findLast((log) => log.level === "error");
const lastErrorIdx = logs.findLastIndex((log) => log.level === "error");Why this matters: [...arr].reverse().find() creates unnecessary copy. findLast is single-pass.
See examples/core.md for findLast patterns.
</patterns>
<red_flags>
High Priority:
JSON.parse(JSON.stringify()) for deep clone - loses Date, Map, Set, undefined. Use structuredClone..sort(), .reverse(), .splice()) on shared state - causes bugs in reactive frameworks. Use ES2023 immutable versions._.get, _.last, _.uniq, _.groupBy) - unnecessary bundle weight.includes() or indexOf() in loops - O(n) per check. Convert to Set first for O(1) lookups.Medium Priority:
arr.slice(-3) - use named constants: const RECENT_COUNT = 3.findLast() instead of [...arr].reverse().find().Object.groupBy() (ES2024).arr[arr.length - 1] for last element - use arr.at(-1).Gotchas & Edge Cases:
structuredClone throws on functions, DOM nodes - use manual clone if these are present.Object.groupBy returns null-prototype object - no hasOwnProperty. Use Object.hasOwn().[...setA.union(setB)].toSorted() with no comparator converts elements to strings (like sort()).at() returns undefined for empty arrays or out-of-bounds indices.</red_flags>
<critical_reminders>
All code must follow project conventions in CLAUDE.md
(You MUST use native ES2022+ methods before considering utility libraries - check this skill first)
(You MUST use immutable array methods (`toSorted`, `toReversed`, `toSpliced`, `with`) instead of mutating methods)
(You MUST use `structuredClone` for deep cloning - NOT JSON.parse/JSON.stringify hacks)
(You MUST define named constants for all numeric values - NO magic numbers in utility functions)
Failure to follow these rules will cause unnecessary bundle bloat and mutation bugs.
</critical_reminders>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.