Skip to content
skillsafebeta
← Report library
Purpose / Development

Modern Javascript Patterns Skill Security Audit

What the author says it does (original text)

Master ES6+ features including async/await, destructuring, spread operators, arrow functions, promises, modules, iterators, generators, and functional programming patterns for writing clean, efficient JavaScript code. Use when refactoring legacy code, implementing modern patterns, or optimizing JavaScript applications.

Independent security check

Security risks found

Files checked
3
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The HTML-template example does not escape interpolated values and can enable script injection when copied

Source references: 1
What we found

`highlight` directly concatenates supplied values into `<mark>` HTML without HTML escaping. Although the example uses a fixed name and age, the general-purpose function does not restrict where values come from.

Why this matters

If a site passes user-submitted names, search terms, or other untrusted text to this function and inserts the result as HTML, an attacker could inject markup or script and act with the current user's page access.

What this evidence establishes

This is a tagged-template demonstration. The function does concatenate values into HTML without escaping, but the visible example passes only a fixed name and age and does not insert the result into the DOM or another HTML-parsing sink. Script injection would require untrusted string input plus later HTML interpretation, neither of which is shown. A user can ask the author to label the helper as unsuitable for untrusted input or provide an escaping example.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
references/details.md:200In the instructionsOpen original file
// Tagged template literalsfunction highlight(strings, ...values) {  return strings.reduce((result, str, i) => {    const value = values[i] || "";    return result + str + `<mark>${value}</mark>`;  }, "");}const name = "John";const age = 30;const html = highlight`Name: ${name}, Age: ${age}`;// Output: "Name: <mark>John</mark>, Age: <mark>30</mark>"```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

The password-class example stores the initial password verbatim and uses a reversible prefix as later “hashing”

Source references: 3
What we found

The constructor assigns the password unchanged to a private field, while `#hashPassword` merely adds a `hashed_` prefix. A JavaScript private field limits code access but is not secure storage or password hashing.

Why this matters

If copied into real authentication or persistence code, passwords could remain in plaintext or an easily reversible form. A data exposure would reveal user credentials directly and could endanger other accounts where passwords were reused.

The teaching example stores the initial password unchanged in a private field, while later password updates only add a fixed `hashed_` prefix. A private field limits ordinary property access but is not secure password hashing; if copied into a real account system, disclosed stored values would reveal or trivially recover passwords. Although this is a modern-class-features example rather than a complete authentication implementation, the copy-use risk is plausible. Users can ask for an explicit non-production warning or a real salted slow-hash example.

references/advanced-patterns.md:255In the instructionsOpen original file
  constructor(id, name, password) {    this.id = id;    this.name = name;    this.#password = password;    User.count++;  }  // Public method  greet() {    return `Hello, ${this.name}`;  }  // Private method  #hashPassword(password) {    return `hashed_${password}`;  }
Show 2 other places
references/advanced-patterns.md:277In the instructionsOpen original file
  // Setter  set password(newPassword) {    this.#password = this.#hashPassword(newPassword);  }
references/advanced-patterns.md:267In the instructionsOpen original file
  // Private method  #hashPassword(password) {    return `hashed_${password}`;  }  // Getter  get displayName() {    return this.name.toUpperCase();  }  // Setter  set password(newPassword) {    this.#password = this.#hashPassword(newPassword);  }
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

3 instruction sections

This is a modern JavaScript programming guide. Its main operational instruction is to consult two reference documents when needed; the supplied material contains no installation steps, command-execution scripts, or instructions to access user files.

View source
SKILL.md:21In the instructionsOpen original file
## Detailed patterns and worked examplesDetailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient.
SKILL.md:43In the instructionsOpen original file
For common pitfalls (this binding, promise anti-patterns, memory leaks), see [references/advanced-patterns.md](references/advanced-patterns.md).

Network requests appear only in instructional code examples, including relative API paths, pagination, and a retry helper; there is no evidence that installing or invoking the Skill would send these requests by itself.

View source
references/details.md:327In the instructionsOpen original file
```javascript// Async function always returns a Promiseasync function fetchUser(id) {  const response = await fetch(`/api/users/${id}`);  const user = await response.json();  return user;}
references/advanced-patterns.md:388In the instructionsOpen original file
// Async generatorasync function* fetchPages(url) {  let page = 1;  while (true) {    const response = await fetch(`${url}?page=${page}`);    const data = await response.json();    if (data.length === 0) break;    yield data;    page++;  }}
Start here · InstructionsSKILL.md
modern-javascript-patterns
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 3
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records3 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/advanced-patterns.mdFull text included
  • references/details.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/advanced-patterns.mdSupporting file
  • references/details.mdSupporting file

Operations mentioned in code and instructions

Read files
SKILL.md:23In the instructionsOpen original file
Detailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient.
Connect to websites
references/advanced-patterns.md:392In the instructionsOpen original file
  while (true) {    const response = await fetch(`${url}?page=${page}`);    const data = await response.json();
references/details.md:330In the instructionsOpen original file
async function fetchUser(id) {  const response = await fetch(`/api/users/${id}`);  const user = await response.json();
references/details.md:378In the instructionsOpen original file
// Top-level await (ES2022)const config = await fetch("/config.json").then((r) => r.json());
Lines read
990
File checksum (to compare versions)
8fc6235a923d58ee2ce1113a2ed12ff2c4c229636c3c3b54f6848e5c4869a5b5