Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add LazyAGI/LazyMind --skill ui-secure-reviewgit clone --depth 1 https://github.com/LazyAGI/LazyMindWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lazyagi/lazymind/ui-secure-review)<a href="https://agentmods.dev/skills/lazyagi/lazymind/ui-secure-review"><img src="https://agentmods.dev/badge/skills/lazyagi/lazymind/ui-secure-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/lazyagi/lazymind/ui-secure-review"><img src="https://agentmods.dev/badge/skills/lazyagi/lazymind/ui-secure-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.00614 |
| Opus 5 | $0.00026 | $0.00307 |
| Sonnet 5 | $0.00010 | $0.00123 |
| Haiku 4.5 | $0.00005 | $0.00061 |
Grade A, and why
ui-secure-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 58 lines — stays where its author put it; the contents beside it link to each section on GitHub.
UI Secure Review
Use this skill when the user asks for a frontend review with a security-first lens.
When to use
- Reviewing PRs that touch UI rendering, routing, auth, storage, or API calls.
- Auditing React, Vue, or plain JavaScript UI code for exploitable patterns.
- Hardening existing UI code before release.
When not to use
- Pure visual polish work with no logic or data handling changes.
- Backend-only or infra-only changes.
Review workflow
- Map changed files and rank risk by feature type.
- Run quick pattern scans for dangerous APIs and sinks.
- Read high-risk files in detail and trace data from input to render.
- Confirm exploitability, impact, and realistic attack path.
- Report findings ordered by severity with exact file and line references.
- Suggest minimum safe fix and regression tests for each finding.
High-risk patterns to check
- HTML injection:
dangerouslySetInnerHTML,v-html,innerHTML,outerHTML. - Script execution:
eval,new Function, string-based timers. - URL and navigation sinks: dynamic
href,window.open, router redirects from untrusted params. - Tabnabbing risk: external links with
target="_blank"missingrel="noopener noreferrer". - Token exposure: auth tokens in query params, logs, localStorage, or error traces.
- Cross-origin trust:
postMessagewithout strictoriginandsourcechecks. - Client-only authorization assumptions that can be bypassed in browser devtools.
- Sensitive data persistence in cache, URL, or browser storage.
Quick scan commands
Use these patterns as a first pass, then manually verify context.
rg -n "dangerouslySetInnerHTML|v-html|innerHTML|outerHTML|eval\(|new Function\(" frontend/src
rg -n "window\.open|postMessage|target=\"_blank\"|localStorage|sessionStorage" frontend/src
rg -n "token|authorization|auth|redirect|location\.href|router\.push" frontend/src
Fix guidance
- Prefer safe templating and escaped rendering over raw HTML insertion.
- Validate and normalize all dynamic URLs before navigation.
- Keep tokens in secure httpOnly cookies when architecture allows.
- Add strict allowlists for cross-origin messaging and navigation targets.
- Enforce authorization on the server even if UI hides actions.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 58 lines · 51 tokens per session scan A 33c753c5d855
ui-secure-review is a skill published in the GitHub repository LazyAGI/LazyMind (77 stars, last pushed yesterday), licensed Apache-2.0. It adds 51 tokens to every session and 614 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
fullstack-dev
Full-stack backend architecture and frontend-backend integration guide. TRIGGER when: building a full-stack app, creating REST API with frontend, scaffolding backend service, building todo app, building CRUD app, building real-time app, building chat app, Express + React, Next.js API, Node.js backend, Python backend…
web-artifacts-builder
Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn/ui). Use for complex artifacts requiring state management, routing, or shadcn/ui components - not for simple single-file HTML/JSX artifacts.
frontend-dev
Full-stack frontend development combining premium UI design, cinematic animations, AI-generated media assets, persuasive copywriting, and visual art. Builds complete, visually striking web pages with real media, advanced motion, and compelling copy. Use when: building landing pages, marketing sites, product pages…
frontend-design
Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, artifacts, posters, or applications (examples include websites, landing pages, dashboards, React components, HTML/CSS layouts, or when styling/beautifying any web UI).…
3d-web-experience
Expert in building 3D experiences for the web - Three.js, React Three Fiber, Spline, WebGL, and interactive 3D scenes. Covers product configurators, 3D portfolios, immersive websites, and bringing dep.
animejs-animation
Advanced JavaScript animation library skill for creating complex, high-performance web animations.