Avoid eval() Security Check
Finds and fixes unsafe eval() and dynamic code execution in JavaScript code.
- Repository
- thedaviddias/Front-End-Checklist
- Stars
- 74,632
- Licence
- MIT
- Files
- 2 files
What it does
This skill gives an AI agent a checklist for one web security rule: never run text as code with eval(), new Function(), or string-based setTimeout/setInterval. When you ask it to review your front-end code, the agent searches for these patterns, explains why they enable cross-site scripting attacks, and proposes safer replacements such as JSON.parse or lookup tables. It is a guided review, not an automatic scanner or fixer that runs on its own.
Great for
- Front-end developers auditing a JavaScript or React codebase for unsafe dynamic code
- Teams preparing for a security review or tightening a Content Security Policy
- Beginners who want a clear explanation of why eval() is risky and what to use instead
Skip it if
- Projects that need a full security audit, since it only covers this single rule and the agent may miss other issues
- Code where eval-like behaviour is needed for trusted, documented reasons; the skill says there is never a legitimate use, so review those cases manually
Try asking
- “Check this codebase for any eval(), new Function(), or setTimeout with a string argument.”
- “Review my client components for unsafe dynamic code execution and suggest fixes.”
- “Explain to my team why eval() enables XSS and what to use instead for parsing JSON.”
- “Replace the eval() call in my config loader with a safe alternative.”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 2 original files, the MIT licence and an attribution note.
avoid-eval.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip avoid-eval.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip avoid-eval.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Point the agent at specific folders or files so it reviews the browser execution path you care about rather than the whole repository.
- Ask it to state how to verify each fix in the browser, as the skill's review step requests this.
- Treat the output as a starting checklist and confirm findings with your own tests and a linter.
What's inside
- references/rule.md
- SKILL.md
Redistributed unmodified from thedaviddias/Front-End-Checklist under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.