XSS sinks
`dangerouslySetInnerHTML`, `v-html`, `[innerHTML]`, `innerHTML`/`document.write`, unsanitised Markdown.
The pack · 11 / 14 →
Frontend
Pointer
the frontend dog. XSS sinks, CSP, postMessage, token storage and third-party scripts.
Comment.tsx
12export function Comment({ body }: Props) {
13 return (
14 <div dangerouslySetInnerHTML={{ __html: body }} /> <div>{body}</div>
15 );
16}
Stored XSS
ExploitA comment with a script steals every viewer's session
FixSmallest change suggested
Pointer is watching$ /watchdog-go-frontend0 found · 0 fixed
What it does
On duty while you build.
The frontend dog. Points at browser-side risk in React, Vue, Angular and plain JS: XSS sinks, CSP, postMessage and token storage.
The always-on lens watches React, Vue, Angular, Svelte, Next.js, HTML templates, browser JavaScript.
What it checks
7 things Pointer looks for.
URL handling
`javascript:` links from data, open redirects, `window.location` from query params.
postMessage
listeners without origin checks, `*` targetOrigin with sensitive data.
Token storage
auth tokens in localStorage, secrets or private API keys in the bundle or env-exposed vars.
CSP and headers
no CSP, `unsafe-inline`/`unsafe-eval`, missing frame-ancestors (clickjacking).
Third-party scripts
unpinned CDN scripts without SRI, tag managers with broad access.
SSR/hydration
server data serialised into HTML without escaping.
Commands
Send Pointer out.
Runs these scanners when installed, then reads the code they can't understand:
- semgrep
- eslint-plugin-security
XSS sinks, CSP, postMessage, token storage, third-party scripts
- /watchdog-go-web
- /watchdog-go-defi
- /watchdog-go-all
Also runs in these bundles.
Benchmark
Tested, not promised.
Its test target holds a Vite + React app with a CSP meta tag: 18 planted issues, 3 decoys and an answer key.
found
Haiku 5.518/18
Sonnet 5.518/18
Opus 5.518/18
Rules of engagement
What Pointer will never do.
- 1
Static review only. Never change live systems or send traffic to targets outside the user's written scope.
- 2
Never print a secret's value — not keys, tokens or passwords, even weak defaults. Give file:line and the secret type only.
- 3
End each review with: what you did not check, and the top risk the user must act on.
FAQ
Pointer, answered.
What does Pointer check for?
Pointer is Watchdog's frontend dog for Claude Code. It looks for XSS sinks, URL handling, postMessage, Token storage, CSP and headers, Third-party scripts and SSR/hydration. Each finding comes with the exact file and line, how it could be abused, and the smallest fix.
How do I run Pointer in Claude Code?
Install Watchdog with /plugin marketplace add watchdoglab/watchdog and /plugin install watchdog@watchdog, then run /watchdog-go-frontend. Its lens also stays on while you code and flags risky lines as they're written.
Which tools does Pointer use?
When they're installed, Pointer runs semgrep and eslint-plugin-security, then reads the code those scanners can't understand. Anything it couldn't check is listed under Not checked in the report.
Is Pointer safe to run on my project?
Yes. Its first rule: Static review only. Never change live systems or send traffic to targets outside the user's written scope. Secrets it finds are reported by location and type only, never printed. Watchdog is free and open source (MIT).