Back to browse

LazyAGI/LazyMind

ui-secure-review

Review frontend and UI changes for concrete security risks such as XSS, unsafe URL handling, token leakage, missing origin checks, and client-side authorization gaps. Use when users ask for a UI code review focused on safety and reliability.

77Collecting
See how to use itView GitHub source
npx skills add https://github.com/LazyAGI/LazyMind --skill "skills/.curated/ui-secure-review"
Automated source guideReview and auditStandard source

Source checked Jul 28, 2026·Refresh due Oct 26, 2026

Reorganized from the pinned upstream SKILL.md

Source-grounded review guide: ui-secure-review

Use this skill when the user asks for a frontend review with a security-first lens.

npx skills add https://github.com/LazyAGI/LazyMind --skill "skills/.curated/ui-secure-review"
Check the pinned source

The pinned source supports a structured brief, but not an expanded tutorial. Only detected inputs, outputs, and sections are shown.

346 source words · 7 usable sections

Best fit

  • Reviewing PRs that touch UI rendering, routing, auth, storage, or API calls.
  • Auditing React, Vue, or plain JavaScript UI code for exploitable patterns.
  • Hardening existing UI code before release.

Evidence and findings

  • Findings first, ordered by severity.
  • Include file path, line, risk, exploit scenario, and concrete fix.
  • Explicitly say "No high-confidence findings" if nothing actionable is found.

Review workflow

Read ui-secure-review through these 4 source sections

Sections are extracted automatically from the pinned SKILL.md and link back to the source.

01

Review workflow

1. Map changed files and rank risk by feature type. 2. Run quick pattern scans for dangerous APIs and sinks. 3. Read high-risk files in detail and trace data from input to render. 4. Confirm exploitability, impact, and realistic attack path. 5. Report findings ordered by severit…

SKILL.md · Review workflow
Map changed files and rank risk by feature type.Run quick pattern scans for dangerous APIs and sinks.Read high-risk files in detail and trace data from input to render.
02

When to use

Reviewing PRs that touch UI rendering, routing, auth, storage, or API calls.

SKILL.md · When to use
Reviewing PRs that touch UI rendering, routing, auth, storage, or API calls.Auditing React, Vue, or plain JavaScript UI code for exploitable patterns.Hardening existing UI code before release.
03

When not to use

Pure visual polish work with no logic or data handling changes.

SKILL.md · When not to use
Pure visual polish work with no logic or data handling changes.Backend-only or infra-only changes.- Pure visual polish work with no logic or data handling changes. - Backend-only or infra-only changes.
04

High-risk patterns to check

HTML injection: dangerouslySetInnerHTML, v-html, innerHTML, outerHTML.

SKILL.md · High-risk patterns to check
HTML injection: dangerouslySetInnerHTML, v-html, innerHTML, outerHTML.Script execution: eval, new Function, string-based timers.URL and navigation sinks: dynamic href, window.open, router redirects from untrusted params.

Review checklist

Verify each item before delivery

The source section “Review workflow” has been checked.

The source section “When to use” has been checked.

The source section “When not to use” has been checked.

The source section “High-risk patterns to check” has been checked.

Source output checked: Findings first, ordered by severity.

Source output checked: Include file path, line, risk, exploit scenario, and concrete fix.

Choose a different workflow

When another Skill is the better fit

suede-workflow-skills

Umbrella workflow for 67 public skills: Full Send, copy, design, code review, SEO, launch packaging, MCP QA, iOS and Android app shipping, and creator workflows. Loads the full public skill pack.

A separate implementation from JasonColapietro/suede-creator-skills; compare its source, maintenance signals, and permission requirements.

Open source detail

copilot-pr-autopilot

Copilot left 14 review comments on your PR — half are nits. Hours of fix → reply → resolve → re-request, and each round lands MORE comments. This skill runs loop engineering: auto-triggers Copilot Code Review via GraphQL (no @copilot mention), triages every open thread (Copilot, humans, advanced-security) with a fix / decline / escalate rubric, dispatches parallel fix sub-agents that obey the repo build/test/lint conventions, commits per iteration, replies+resolves citing the pushed SHA, then re

A separate implementation from github/awesome-copilot; compare its source, maintenance signals, and permission requirements.

Open source detail

suede-code-review

Find the bugs a diff can actually ship: TypeScript, React, Next.js, OWASP, accessibility, SEO, database, and deploy-risk review. Return findings, not a grade.

A separate implementation from JasonColapietro/suede-creator-skills; compare its source, maintenance signals, and permission requirements.

Open source detail

FAQ

What does the ui-secure-review source document cover?

Use this skill when the user asks for a frontend review with a security-first lens.

How do I install ui-secure-review?

The source record exposes this install command: npx skills add https://github.com/LazyAGI/LazyMind --skill "skills/.curated/ui-secure-review". Inspect the command and pinned source before running it.

Repository stars
55
Repository forks
38
Quality
77/100
Source repository last pushed

Quality breakdown

Based on traceable docs and repository signals; stars are not treated as quality.

77/100
Documentation24/30
Specificity18/25
Maintenance18/20
Trust signals17/25

Compare before choosing

Related Agent Skills and source variants

These links are selected from shared tasks, functions, stacks, platforms, and same-name variants. Compare the source owner, documentation, permissions, and maintenance signals.

suede-workflow-skills by JasonColapietro

Umbrella workflow for 67 public skills: Full Send, copy, design, code review, SEO, launch packaging, MCP QA, iOS and Android app shipping, and creator workflows. Loads the full public skill pack.

copilot-pr-autopilot by github

Copilot left 14 review comments on your PR — half are nits. Hours of fix → reply → resolve → re-request, and each round lands MORE comments. This skill runs loop engineering: auto-triggers Copilot Code Review via GraphQL (no @copilot mention), triages every open thread (Copilot, humans, advanced-security) with a fix / decline / escalate rubric, dispatches parallel fix sub-agents that obey the repo build/test/lint conventions, commits per iteration, replies+resolves citing the pushed SHA, then re

suede-code-review by JasonColapietro

Find the bugs a diff can actually ship: TypeScript, React, Next.js, OWASP, accessibility, SEO, database, and deploy-risk review. Return findings, not a grade.

postgresql-code-review by github

PostgreSQL-specific code review assistant focusing on PostgreSQL best practices, anti-patterns, and unique quality standards. Covers JSONB operations, array usage, custom types, schema design, function optimization, and PostgreSQL-exclusive security features like Row Level Security (RLS).

security-threat-model by openai

Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.

View original Skill.mdThis page is parsed directly from the repository SKILL.md without editorial rewriting. Collected: Jul 28, 2026 · about 2 min

UI Secure Review

Use this skill when the user asks for a frontend review with a security-first lens.

When to use

  • Reviewing PRs that touch UI rendering, routing, auth, storage, or API calls.
  • Auditing React, Vue, or plain JavaScript UI code for exploitable patterns.
  • Hardening existing UI code before release.

When not to use

  • Pure visual polish work with no logic or data handling changes.
  • Backend-only or infra-only changes.

Review workflow

  1. Map changed files and rank risk by feature type.
  2. Run quick pattern scans for dangerous APIs and sinks.
  3. Read high-risk files in detail and trace data from input to render.
  4. Confirm exploitability, impact, and realistic attack path.
  5. Report findings ordered by severity with exact file and line references.
  6. Suggest minimum safe fix and regression tests for each finding.

High-risk patterns to check

  • HTML injection: dangerouslySetInnerHTML, v-html, innerHTML, outerHTML.
  • Script execution: eval, new Function, string-based timers.
  • URL and navigation sinks: dynamic href, window.open, router redirects from untrusted params.
  • Tabnabbing risk: external links with target="_blank" missing rel="noopener noreferrer".
  • Token exposure: auth tokens in query params, logs, localStorage, or error traces.
  • Cross-origin trust: postMessage without strict origin and source checks.
  • Client-only authorization assumptions that can be bypassed in browser devtools.
  • Sensitive data persistence in cache, URL, or browser storage.

Quick scan commands

Use these patterns as a first pass, then manually verify context.

rg -n "dangerouslySetInnerHTML|v-html|innerHTML|outerHTML|eval\(|new Function\(" frontend/src
rg -n "window\.open|postMessage|target=\"_blank\"|localStorage|sessionStorage" frontend/src
rg -n "token|authorization|auth|redirect|location\.href|router\.push" frontend/src

Fix guidance

  • Prefer safe templating and escaped rendering over raw HTML insertion.
  • Validate and normalize all dynamic URLs before navigation.
  • Keep tokens in secure httpOnly cookies when architecture allows.
  • Add strict allowlists for cross-origin messaging and navigation targets.
  • Enforce authorization on the server even if UI hides actions.

Output contract

  • Findings first, ordered by severity.
  • Include file path, line, risk, exploit scenario, and concrete fix.
  • Explicitly say "No high-confidence findings" if nothing actionable is found.
  • Mention residual test gaps or assumptions.
Source repo
LazyAGI/LazyMind
Skill path
skills/.curated/ui-secure-review/SKILL.md
Commit SHA
b63cc44f8c68
Repository license
Apache-2.0
Data collected