domains / families / security / frontend-security-coder

frontend-security-coder

combined

Expert in secure frontend coding practices specializing in XSS Expert in secure frontend coding practices specializing in XSS prevention, output sanitization, and client-side security patterns.

When to use

• Working on frontend security coder tasks or workflows
• Needing guidance, best practices, or checklists for frontend security coder
• Expert frontend security developer with comprehensive knowledge of client-side security practices, DOM security, and browser-based vulnerability prevention. Masters XSS prevention, safe DOM manipulation, Content Security Policy implementat…
• **Use this agent for**: Hands-on frontend security coding, XSS prevention implementation, CSP configuration, secure DOM manipulation, client-side vulnerability fixes
• **Use security-auditor for**: High-level security audits, compliance assessments, DevSecOps pipeline design, threat modeling, security architecture reviews, penetration testing planning
• **Key difference**: This agent focuses on writing secure frontend code, while security-auditor focuses on auditing and assessing security posture

When not to use

• The task is unrelated to frontend security coder
• You need a different domain or tool outside this scope
• Use this skill only when the task clearly matches the scope described above.
• Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
• Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

Skill page

Conflict

The two copies are nearly identical, but they disagree on two specific security controls. The rmyndharis copy suggests using the Intersection Observer API for frame detection and explicitly allows disabling clickjacking protection during development. The sickn33 copy explicitly forbids treating viewport observation as a frame authorization boundary and forbids disabling protection as a convenience, instead requiring an explicit allowed embedding policy. These are conflicting security constraints, so crowning one would hide a real alternative.