senior-frontend Security Audit Report

🔭 Continuously monitored by ClawSecure Watchtower

Source:

SHA-256:

senior-frontend is an AI agent skill, created by alirezarezvani and published at openclaw/skills. ClawSecure audited senior-frontend across 8 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 75/100 (Medium Risk). The 5 findings concentrate in ReDoS, Policy Violation and Supply Chain Attack, including Pattern detected: .pnp.js and Missing config.json - agent may not be properly configured. 1 was rated high or critical severity.

Is senior-frontend safe?

ClawSecure audited senior-frontend and assigned a security score of 75/100 (Medium Risk), identifying 5 findings across ReDoS and Policy Violation. Review the findings below before installing.

What did ClawSecure find in senior-frontend?

ClawSecure identified 5 findings in senior-frontend, concentrated in ReDoS, Policy Violation and Supply Chain Attack. 1 was rated high or critical severity. The most severe include Pattern detected: .pnp.js and Missing config.json - agent may not be properly configured.

How was senior-frontend audited?

ClawSecure ran senior-frontend through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 8 files from openclaw/skills.

What does a score of 75 mean?

ClawSecure assigned senior-frontend a security score of 75/100, placing it in the Medium Risk range. This reflects 5 findings led by ReDoS that warrant review before production use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).

Audit Findings for senior-frontend

ClawSecure detected 5 security findings in senior-frontend, spanning ReDoS, Policy Violation, Supply Chain Attack and Permissions Manifest.

high · Pattern detected: .pnp.js. Supply Chain Attack finding detected in scripts/frontend_scaffolder.py:789.
medium · Missing config.json - agent may not be properly configured. Permissions Manifest finding.
medium · ReDoS vulnerability: Extremely large quantifier range (potential DoS) —.... ReDoS finding detected in SKILL.md:318.
medium · ReDoS vulnerability: Extremely large quantifier range (potential DoS) —.... ReDoS finding detected in nextjs_optimization_guide.md:133.
info · Skill manifest does not include a 'license' field. Specifying a license.... Policy Violation finding detected in SKILL.md.

Each finding is expandable in the interactive list below.

3-Layer Audit Protocol

Security Recommendations for senior-frontend

Fix ReDoS-prone patterns

senior-frontend contains regular expressions vulnerable to catastrophic backtracking (ReDoS). Replace vulnerable patterns, bound input length, and prefer linear-time matching so a crafted input cannot hang the agent.

Resolve policy violations

senior-frontend trips ClawSecure policy checks. Review each flagged pattern against your security policy and remediate or document an accepted exception before production use.

Add a config.json permissions manifest

A config.json file declares what an agent component can access: file system, network, shell execution and more. Without it, users have no visibility into what the component can do before installing. This is the single most impactful security improvement for any AI agent skill.

Pin dependencies to exact versions

Unpinned dependencies allow supply-chain attacks where a compromised version is pulled in automatically. Use exact version numbers in package.json (for example 1.2.3 instead of ^1.2.3) to keep unauthorized code out of your dependency tree. ClawSecure checks every dependency against known CVE databases.

Related Security Research

Why Generic Scanners Fail at AI Agent Security→Understanding Our 3-Layer Audit Protocol→OWASP ASI Top 10 Explained: The Complete Guide to AI Agent Security Standards→

Related AI Agent Security Audits

remindctlScore 69/100 ui-ux-pro-max-skillScore 75/100 clawdhubScore 75/100 zeroclawScore 85/100 antigravity-awesome-skillsScore 75/100

Scanned on March 12, 2026. senior-frontend is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.

Start Your Free Scan