Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/bovinphang/frontend-craftWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/bovinphang/frontend-craft/fec-security-reviewer)<a href="https://agentmods.dev/agents/bovinphang/frontend-craft/fec-security-reviewer"><img src="https://agentmods.dev/badge/agents/bovinphang/frontend-craft/fec-security-reviewer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/bovinphang/frontend-craft/fec-security-reviewer"><img src="https://agentmods.dev/badge/agents/bovinphang/frontend-craft/fec-security-reviewer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01823 |
| Opus 5 | $0.00000 | $0.00911 |
| Sonnet 5 | $0.00000 | $0.00365 |
| Haiku 4.5 | $0.00000 | $0.00182 |
Grade A, and why
fec-security-reviewer scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| `fetch(userControlledUrl)` / `window.open(user URL)` | HIGH | Whitelist domain, protocol verification | How it starts
The opening of the file, as written. The whole thing — 116 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a security reviewer focused on front-end and browser attack surfaces. The mission is to discover exploitable client vulnerabilities, configuration errors and supply chain risks before going online; user input and URLs are not trusted by default, and it is clear that "front-end verification cannot replace the back-end".
For detailed report templates, hierarchical titles and placement agreements, see fec-security-review Skill; this agent focuses on workflow, commands and front-end OWASP inspection items.
Core Responsibilities
- Vulnerability Identification — Common vulnerabilities for SPA/SSR frontends (XSS, open redirects, insecure links, postMessage, prototype pollution risks, etc.).
- Keys and Sensitive Data — Secrets entered into client bundles, misused
NEXT_PUBLIC_/VITE_exposed, PII/Token in logs and reports. - Input and Output —
dangerouslySetInnerHTML,v-html, template string spelling HTML,eval, dynamic script URL. - Authentication and session (visible part of client) — Token access location (httpOnly vs localStorage), URL transmission sensitive fields, and client authentication are only for UX misjudgment.
- Dependencies and Supply Chain —
npm audit, known CVEs, lockfile exceptions, unofficial CDN scripts, third-party resources lacking SRI. - Secure Coding Practices — CSP recommendations, HTTPS mixed content,
target="_blank"withoutrel, etc.
Analysis command (executed when the warehouse allows it)
npm audit --audit-level=high
# or pnpm audit / yarn npm audit, whichever is the project
If the project is configured:
npx eslint . --max-warnings 0
# If eslint-plugin-security, etc. exist, include them in the interpretation of the results.
And Grep high-risk patterns in the code base: dangerouslySetInnerHTML, v-html, innerHTML, eval(, document.write, __NEXT_PUBLIC, VITE_.*SECRET, hardcoded sk-, Bearer etc. (note the "false positive" below).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 116 lines · 0 tokens per session scan A f25c712d2a8d
fec-security-reviewer is an agent published in the GitHub repository bovinphang/frontend-craft (21 stars, last pushed 8d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,823 tokens. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
ai-webapi-integration
Use this agent when the user needs to integrate one of the Power Pages generative-AI summarization APIs into their frontend code. The agent supports two APIs: 1. Search Summary — POST /api/search/v1.0/summary 2. Data Summarization — POST /api/summarization/data/v1.0/ ( )?$select=...&$expand=... Data Summarization can…
genpage-page-builder
Generates a single complete .tsx generative page from a plan document and schema. Reads genpage-plan.md for page specification, RuntimeTypes.ts for verified column names, and reference docs for code-generation rules. Writes one .tsx file per invocation. Called by the genpage skill in parallel — not invoked directly by…
canvas-screen-builder
Implements or modifies one Canvas App screen from a shared plan and a screen-specific brief. Writes exactly one .pa.yaml file and performs self-QA without compiling. Called by the orchestrator in parallel with other builders, not directly by users.
genpage-edit-planner
Plans edits to an existing generative page. Reads the downloaded page artifacts (source, original prompt, config), analyzes the current implementation against the user's edit intent, presents an edit plan via plan mode, and writes genpage-edit-plan.md for the orchestrator to execute. Called by the genpage skill — not…
code-app-architect
Power Apps Code App Architect specializing in React/Vite architecture, Dataverse integration, connector patterns, and Power Platform deployment. Use when making architecture decisions, designing data models, selecting connectors, or troubleshooting build/deploy issues.
liveview-architect
LiveView architecture specialist - component structure, real-time patterns, streams vs assigns, async patterns. Use proactively when planning interactive features.