CtrlK
BlogDocsLog inGet started
Tessl Logo

JavaScript 安全审查

检查 XSS、CSRF、原型污染等安全问题，支持 React/Vue/Angular

Invalid
This skill can't be scored yet
Validation errors are blocking scoring. Review and fix them to unlock Quality, Impact and Security scores. See what needs fixing →
SKILL.md
Quality
Evals
Security

JavaScript 安全审查

⚠️ 核心规则

  1. 永不信任用户输入 - 所有用户数据需校验和转义
  2. 默认安全 - 使用安全 API（textContent 而非 innerHTML）
  3. 纵深防御 - 多层安全措施，不依赖单一防护

快速开始

/js-security-check                    # 智能扫描 src 目录
/js-security-check file src/xxx.vue   # 扫描指定文件
/js-security-check report             # 生成详细报告

问题分级

前缀含义处理方式
🔴 严重可被直接利用阻止发布
🟡 中等需特定条件尽快修复
⚪ 建议最佳实践可选优化

检查维度

维度检查项
DOM 安全innerHTML、document.write、insertAdjacentHTML
URL 安全Open Redirect、javascript: scheme
代码执行eval、new Function、setTimeout(string)
原型污染proto、constructor、Object.assign
存储安全localStorage 敏感信息、Cookie 属性
框架安全v-html、dangerouslySetInnerHTML

📦 按需加载资源

资源URI
完整检查清单skill://js-security-check/references/checklist.md
修复示例skill://js-security-check/references/fix-examples.md
评分标准skill://js-security-check/references/scoring-standard.md

📦 可用资源

  • skill://js-security-check/references/checklist.md
  • skill://js-security-check/references/fix-examples.md
  • skill://js-security-check/references/report-format.md
  • skill://js-security-check/references/scoring-standard.md
  • skill://js-security-check/references/security-toolkit.md

根据 SKILL.md 中的 IF-THEN 规则判断是否需要加载

Repository
TencentBlueKing/bk-bcs
Commit

b08ac38

Last updated
Created

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

Claim skill