typescript-security-review — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited typescript-security-review (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Security review for TypeScript/Node.js applications. Evaluates code against OWASP Top 10, framework-specific patterns, and production-readiness criteria. Findings are classified by severity (Critical, High, Medium, Low) with remediation examples. Delegates to the typescript-security-expert agent for deep analysis.
grep to find security-sensitive patterns (eval, exec, innerHTML, password handling, JWT operations).Checkpoint: Verify at least 3 security-sensitive files/modules identified before proceeding.
Checkpoint: Use grep to confirm all route handlers have auth guards or middleware applied.
exec/spawn, template injection, and LDAP injection. Verify parameterized queries and input validation.Checkpoint: Use grep to confirm all database queries use parameterization — no string concatenation with user input.
Checkpoint: Verify all public API endpoints have corresponding validation schemas.
dangerouslySetInnerHTML usage, check Content Security Policy headers, verify HTML sanitization for user-generated content. See references/xss-prevention.md for detailed patterns.Checkpoint: Use grep to confirm any dangerouslySetInnerHTML usage has sanitization via DOMPurify or equivalent.
.env files are gitignored, secrets accessed through proper management services.Checkpoint: Run grep -r "password\|secret\|api.*key\|token" --include="*.ts" to identify potential secrets in code.
npm audit or check package-lock.json for known vulnerabilities. Identify outdated dependencies with CVEs. Check for unnecessary dependencies.Checkpoint: Verify npm audit results are reviewed and critical vulnerabilities addressed.
references/security-headers.md for configuration examples.Checkpoint: Use grep to confirm helmet or equivalent security headers are applied globally.
Feedback Loop: If Critical or High vulnerabilities found, re-scan related modules for similar patterns before finalizing. Use grep to identify if the same vulnerability pattern exists elsewhere.
// ❌ Critical: Weak JWT configuration
import jwt from 'jsonwebtoken';
const SECRET = 'mysecret123'; // Hardcoded weak secret
function generateToken(user: User) {
return jwt.sign({ id: user.id, role: user.role }, SECRET);
// Missing expiration, weak secret, no algorithm specification
}
// ✅ Secure: Proper JWT configuration
import jwt from 'jsonwebtoken';
const JWT_SECRET = process.env.JWT_SECRET;
if (!JWT_SECRET || JWT_SECRET.length < 32) {
throw new Error('JWT_SECRET must be set and at least 32 characters');
}
function generateToken(user: User): string {
return jwt.sign(
{ sub: user.id }, // Minimal claims, no sensitive data
JWT_SECRET,
{
algorithm: 'HS256',
expiresIn: '15m',
issuer: 'my-app',
audience: 'my-app-client',
}
);
}
function verifyToken(token: string): JwtPayload {
return jwt.verify(token, JWT_SECRET, {
algorithms: ['HS256'], // Restrict accepted algorithms
issuer: 'my-app',
audience: 'my-app-client',
}) as JwtPayload;
}// ❌ Critical: SQL injection vulnerability
async function findUser(email: string) {
const result = await db.query(
`SELECT * FROM users WHERE email = '${email}'`
);
return result.rows[0];
}
// ✅ Secure: Parameterized query
async function findUser(email: string) {
const result = await db.query(
'SELECT id, name, email FROM users WHERE email = $1',
[email]
);
return result.rows[0];
}
// ✅ Secure: ORM with type-safe queries (Drizzle example)
async function findUser(email: string) {
return db.select({
id: users.id,
name: users.name,
email: users.email,
})
.from(users)
.where(eq(users.email, email))
.limit(1);
}See references/xss-prevention.md for XSS patterns and references/security-headers.md for security headers configuration.
Structure all security review findings as follows:
Overall security assessment score (1-10) with key observations and risk level.
Issues that can be exploited to compromise the system, steal data, or cause unauthorized access.
Security misconfigurations, missing protections, or vulnerabilities requiring near-term remediation.
Issues that reduce security posture but have mitigating factors or limited exploitability.
Security improvements, hardening recommendations, and defense-in-depth enhancements.
Well-implemented security patterns and practices to acknowledge.
Prioritized action items with code examples for the most critical fixes.
HttpOnly, Secure, SameSite=Strictnpm audit in CI pipelines to catch dependency vulnerabilitiesSee the references/ directory for detailed security documentation:
references/owasp-typescript.md — OWASP Top 10 mapped to TypeScript/Node.js patternsreferences/common-vulnerabilities.md — Common vulnerability patterns and remediationreferences/dependency-security.md — Dependency scanning and supply chain securityreferences/xss-prevention.md — XSS prevention patterns for React and server-sidereferences/security-headers.md — Security headers and CORS configuration examplesreferences/input-validation.md — Input validation patterns with Zod and class-validator~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.