Guide · Agent skill
How to use the Avoid eval() Security Check agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The avoid-eval skill is a checklist that an AI agent follows when reviewing front-end code for one security rule: never run text as code with eval(), new Function(), or string-based setTimeout and setInterval. It is aimed at front-end developers, beginners learning why eval() is risky, and teams preparing a security review. After this guide you will know what the skill does, how to install it, how to ask for a review in plain language, and what to check in its output.
Avoid eval() Security Checkthedaviddias/Front-End-Checklist · MIT Download the skill Quick start
- 1Download the ZIP. Download the avoid-eval skill ZIP from this page and unzip it. You should see SKILL.md and references/rule.md.
- 2Choose a location. Place the folder in ~/.claude/skills/ for all projects, or in your project's .claude/skills/ folder for one project only.
- 3Or upload it in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the skill.
- 4Ask for a review. Describe what to check in plain language, such as reviewing a specific folder for eval() or new Function() calls.
- 5Read each finding. For every match, check the file, the risk explanation, and the proposed safer replacement.
- 6Verify in the browser. Confirm the fix works in the browser, as the skill's review step asks, and re-run the check.
What is an agent skill, and what does avoid-eval make the agent do?
An agent skill is a folder of instructions that an AI agent loads when your request matches the skill's description. The avoid-eval skill is built around one rule from the Front-End Checklist: never use eval() or unsafe dynamic code execution.
When you ask for a review, the agent searches your codebase for eval(), new Function(), and setTimeout or setInterval calls that receive strings. It explains why these enable cross-site scripting (XSS) attacks, and proposes safer replacements such as JSON.parse for data, object lookups for dynamic dispatch, and function references for timers. The skill is a guided review. It is not an automatic scanner or fixer that runs on its own.
- Check: search the codebase for eval(), new Function(), and string-argument timers.
- Explain: why each use is dangerous and what safe alternative fits it.
- Fix: replace calls with JSON.parse, lookup tables, or function references.
- Code review: flag exact imports, event handlers, or runtime side effects that break the rule, and say how to verify the change in the browser.
Install the avoid-eval skill
Download the ZIP for the avoid-eval skill from this page and unzip it. The skill folder contains SKILL.md and references/rule.md. Put the unzipped folder in one of two places, depending on how you want to use it.
To make the skill available to Claude Code for all your projects, place it in ~/.claude/skills/. To make it available only inside one project, place it in that project's .claude/skills/ folder.
If you use the Claude apps instead, upload the skill under Settings → Capabilities → Skills.
- Personal (all projects): ~/.claude/skills/avoid-eval/
- Single project: <your-project>/.claude/skills/avoid-eval/
- Claude apps: Settings → Capabilities → Skills, then upload the skill.
How do you trigger the skill with a natural request?
You do not need a special command. The agent reads the skill's description and uses it when your request is about reviewing scripts, client components, bundles, or runtime behaviour related to eval() or unsafe dynamic code execution. Name the thing you care about, and say what kind of help you want.
Mention the scope when you can. A specific folder or component gives the agent a narrower search and a clearer answer than the whole repository.
- Check my React app for eval() or new Function() calls.
- Review src/components for string-based setTimeout or setInterval.
- Explain why this eval() call is dangerous and what I should use instead.
- Audit the bundle-related code in this project for unsafe dynamic code execution.
What should you expect from an example review?
The skill's reference file shows the pattern it looks for. For example, passing user input to eval() lets an attacker run any JavaScript in your users' browsers, and new Function() carries the same risk. The reference also shows the same idea with setTimeout and setInterval when they receive a string.
A good response from the agent should list each match with its file, explain the risk in plain terms, and propose a replacement. Check that the replacement keeps the behaviour you need. For example, JSON data should go through JSON.parse rather than eval().
- Each finding names the exact file and line.
- Each finding explains how the code could enable XSS.
- Each finding proposes a specific safer replacement.
- The agent states how to verify the change in the browser.
// Unsafe
eval(userInput)
const fn = new Function('x', 'return ' + userExpression)
// Safer data parsing
JSON.parse(text)What does the skill need, and what are the safety notes?
The skill lists no requirements. It does not run scripts and does not use the network, according to its metadata. Its contents are instructions and reference text, so it works by guiding the agent's own search and review of your code.
Because the skill covers only this one rule, it can miss other problems. Treat its output as one part of a review, not a full security audit. Review any eval-like code that you believe is needed for a trusted, documented reason by hand, since the skill states there is never a legitimate use for it.
- Requirements: none listed.
- Runs scripts: no.
- Uses network: no.
- Scope: this single rule only; it is not a full security audit.
Tips for getting better results
Give the agent the context it needs: the framework, the folder, and whether the code handles user input. Ask for the verification step too, so you know how to confirm the fix in a real browser. If you are tightening a Content Security Policy, say so, because the skill notes that CSP blocks eval() but not new Function().
- Name the framework (for example, React) and the folder to search.
- Ask the agent to explain each finding so you learn the reason, not just the fix.
- Re-run the check after changes to confirm no matches remain.
- Check the full reference at references/rule.md for framework-specific guidance.
What people use it for
- Auditing a React or JavaScript codebase for eval() and new Function() calls before a release.
- Preparing for a security review by listing every string-based timer and dynamic code path.
- Replacing eval() used for parsing JSON data with JSON.parse.
- Learning why eval() enables XSS by asking the agent to explain each finding.
- Tightening a Content Security Policy by finding code that new Function() would still allow.
Frequently asked questions
How do I install the avoid-eval skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for all projects, or into a project's .claude/skills/ folder for one project. If you use the Claude apps, upload it under Settings → Capabilities → Skills.
Does the avoid-eval skill require anything else?
The skill lists no requirements. It does not run scripts and does not use the network, so it is made of instructions and reference text that guide the agent's review.
Is avoid-eval free to use?
The skill is published under the MIT licence, as stated on this page. The source does not mention pricing, so check the repository for any further terms.
Will avoid-eval find all security problems in my code?
No. It covers only the rule against eval(), new Function(), and string-based timers. It can miss other issues, so it is not a full security audit.
Can I use avoid-eval if my project needs eval()?
The skill says there is never a legitimate use for eval() that cannot be solved another way. For code that you believe needs eval-like behaviour for a trusted, documented reason, review it manually rather than relying on the skill.
How is avoid-eval different from an automatic scanner?
The skill is a guided review. The agent searches for the patterns, explains the risk, and proposes fixes when you ask. It does not run on its own or change your code automatically.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use avoid-eval if you are a front-end developer or beginner who wants a clear, guided review of eval(), new Function(), and string-based timers in a JavaScript or React codebase. Pick a full security audit tool or a dedicated scanner if you need coverage beyond this single rule, and review any intentional eval-like code by hand.
Download the skill