dom-security-hardening — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited dom-security-hardening (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
XSS attacks kill applications. This skill hardens the DOM attack surface by enforcing a strict Content Security Policy, eliminating unsafe DOM APIs, and stripping execution vectors like inline scripts and styles. Following this skill is MANDATORY for any user-facing web application handling user input.
index.html or document root of a web application<meta http-equiv="Content-Security-Policy"> tag in HTML <head> (or HTTP headers)<script> and <style> blocks into separate .js and .css filesonclick="...", onchange="..." with standard addEventListener bindingsinnerHTML, outerHTML, dangerouslySetInnerHTML with textContent or innerTextdefault-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'<script> blocks in HTMLstyle="..." attributeseval(), setTimeout(string), new Function(string)innerHTML, outerHTML, or dangerouslySetInnerHTML with user inputtextContent or innerText for all dynamic text insertions'unsafe-inline' or 'unsafe-eval' in CSPelement.innerHTML = userInput (immediate XSS)href="javascript:void(0)" or href="javascript:alert(1)"Content-Security-Policy: default-src *; script-src 'unsafe-inline'innerHTML used with user inputdangerouslySetInnerHTML used without sanitization'unsafe-inline' or 'unsafe-eval'<script> tags with inline code (all external)style="..." attributes (all CSS classes)onclick, onchange, oninput inline event handlerstextContent or innerTextinnerHTML, outerHTML, or dangerouslySetInnerHTML with user inputeval(), setTimeout(string), new Function(string) calls<head>, external <script> tags at end of <body>textContent, className, setAttribute).css files, no inline styles anywhere'unsafe-inline' or 'unsafe-eval' in CSP, ignore sanitization requirements, leave inline event handlers❌ Anti-pattern (Unsafe XSS vectors, no CSP):
<!-- No CSP -->
<a href="javascript:void(0)" onclick="submitForm()">Click me</a>
<div id="user-bio"></div>
<script>
// Unsafe: direct user input to DOM
document.getElementById('user-bio').innerHTML = getUserInput();
// Unsafe: inline style
document.getElementById('user-bio').setAttribute('style', 'color: red;');
// Unsafe: event handler string
setTimeout("console.log('vulnerable')", 1000);
</script>✅ Correct pattern (Hardened, safe):
<!-- Strict CSP enforced -->
<meta http-equiv="Content-Security-Policy"
content="default-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'; img-src 'self' https:; font-src 'self';"
>
<a href="#" id="submit-btn">Click me</a>
<div id="user-bio"></div>
<!-- External script only -->
<script src="/js/app.js"></script>// app.js
// 1. Safe event binding
document.getElementById('submit-btn').addEventListener('click', (e) => {
e.preventDefault();
submitForm();
});
// 2. Safe text insertion (escapes HTML by default)
document.getElementById('user-bio').textContent = getUserInput();
// 3. Safe styling via CSS classes
document.getElementById('user-bio').classList.add('text-red');
// 4. If HTML rendering is absolutely required, sanitize first
import DOMPurify from 'dompurify';
document.getElementById('user-bio').innerHTML = DOMPurify.sanitize(getUserMarkdown());~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.