git:20260607.44659b6 to git:20260611.9d7f5e4

20 added, 20 removed. Audit A to A.

---

name: fec-security-review

- description: Use when reviewing frontend security risks such as XSS, CSRF, sensitive data exposure, unsafe DOM APIs, untrusted user input, authentication/token handling, payment flows, file upload, CSP, dependency risk, or third-party scripts; Chinese triggers include 安全审查, 安全检查.

+ description: Use when reviewing frontend security risks such as XSS, CSRF, sensitive data exposure, unsafe DOM APIs, untrusted user input, authentication/token handling, payment flows, file upload, CSP, dependency risk, or third-party scripts; Chinese triggers include security review, security check.

---

- # 前端安全审查

+ # Front-end security review

## Purpose

- 识别前端代码中的客户端安全风险，并给出可执行修复建议。

+ Identify client-side security risks in front-end code and recommend actionable fixes.

## Procedure

- 1. 先确认审查面：用户输入、动态 HTML、URL 跳转、认证态、RBAC、文件上传、支付/删除等敏感操作、第三方脚本和依赖。

- 2. 搜索高危模式：`dangerouslySetInnerHTML`、`v-html`、`innerHTML`、`document.write`、动态 script、未校验 redirect、明文 token。

- 3. 按风险类型审查：XSS、CSP、敏感数据、CSRF、依赖、输入校验、文件上传、开放重定向、认证授权和第三方脚本。

- 4. 用边界模型判断责任：客户端只能改善体验和减少误用，鉴权、授权、上传信任和敏感操作必须由服务端最终裁决。

- 5. 高危问题标记为阻塞合并；前端校验只能改善体验，不能作为唯一安全边界。

- 6. 输出分级安全报告；报告格式见 [references/report-template.md](references/report-template.md)。

+ 1. First confirm the review areas: user input, dynamic HTML, URL jump, authentication status, RBAC, file upload, payment/deletion and other sensitive operations, third-party scripts and dependencies.

+ 2. Search for high-risk patterns: `dangerouslySetInnerHTML`, `v-html`, `innerHTML`, `document.write`, dynamic script, unverified redirect, and plain text token.

+ 3. Review by risk type: XSS, CSP, sensitive data, CSRF, dependencies, input validation, file upload, open redirection, authentication authorization and third-party scripts.

+ 4. Use the boundary model to determine responsibility: The client can only improve the experience and reduce misuse. Authentication, authorization, upload trust and sensitive operations must be finalized by the server.

+ 5. High-risk issues are marked as blocking merges; front-end verification can only improve the experience and cannot be used as the only security boundary.

+ 6. Output a hierarchical security report; see [references/report-template.md](references/report-template.md) for the report format.

- ## 详细参考

+ ## Detailed reference

- - 需要 XSS、CSP、敏感数据、CSRF、依赖和输入校验细节时，加载 [references/security-checklist.md](references/security-checklist.md)。

- - 撰写安全审查报告时，加载 [references/report-template.md](references/report-template.md)。

+ - Load [references/security-checklist.md](references/security-checklist.md) when XSS, CSP, sensitive data, CSRF, dependencies and input validation details are required.

+ - When writing a security review report, load [references/report-template.md](references/report-template.md).

## Constraints

- - 不要为了方便开发而绕过安全机制。

- - 不要依赖前端校验作为唯一安全防线。

- - 不要信任任何来自客户端的数据。

- - 发现高危问题时必须标记为阻塞合并。

- - 与通用代码质量 review 分工：本 skill 关注威胁、攻击面和数据泄露。

- - 不把依赖审计结果机械等同为可利用漏洞；需要结合运行路径、暴露面和修复成本判断。

- - 不把隐藏按钮、前端路由守卫或本地角色字段当作授权边界；API、SSR loader、server action 和敏感操作必须有服务端裁决。

+ - Don't bypass security mechanisms to facilitate development.

+ - Don't rely on front-end validation as your only line of security.

+ - Do not trust any data coming from the client.

+ - High-risk issues must be marked as blocking merges when found.

+ - Separated from general code quality review: This skill focuses on threats, attack surfaces, and data breaches.

+ - Do not mechanically equate dependence on audit results with exploitable vulnerabilities; judgments need to be made based on the running path, exposure surface and repair cost.

+ - Do not treat hidden buttons, front-end route guards, or local role fields as authorization boundaries; APIs, SSR loaders, server actions, and sensitive operations must have server-side arbitration.

## Expected Output

- 输出 CRITICAL/HIGH/MEDIUM/LOW 分级安全审查报告，每个问题关联具体文件和行号，给出修复建议；报告保存为 `reports/security-review-YYYY-MM-DD-HHmmss.md`。

+ Output a CRITICAL/HIGH/MEDIUM/LOW graded security review report. Each issue is associated with a specific file and line number, and repair suggestions are given; the report is saved as `reports/security-review-YYYY-MM-DD-HHmmss.md`.