javascript-pro

An agent skill by Jeffallan, from Jeffallan/claude-skills. Tags: cli, debugging, developer-tools, javascript, performance, web.

What it does

Writes, debugs, and refactors JavaScript code using modern ES2023+ features, async/await patterns, ESM module systems, and Node.js APIs. Use when building vanilla JavaScript applications, implementing Promise-based async flows, optimising browser or Node.js performance, working with Web Workers or Fetch API, or reviewing .js/.mjs/.cjs files for correctness and best practices.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add Jeffallan/claude-skills --skill javascript-pro

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/Jeffallan/claude-skills
cp -r claude-skills/skills/javascript-pro ~/.claude/skills/javascript-pro

Safety box score

Grade B, low risk: 19 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is a documentation-only JavaScript skill: it ships no executable scripts, but it does tell the agent to run local lint/test tools and includes examples using Node filesystem, child-process, and browser fetch APIs. The main risk is local code execution and file changes inside the project; there is no built-in privilege escalation or hidden prompt injection.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	The workflow explicitly tells the agent to run local tools — `eslint --fix`, DevTools/`--inspect`, and Jest — which will execute project code and test fixtures.
Network access	1 (low)	The references include network-capable examples such as `fetch('/api/data')`, `fetch('https://mirror1.example.com/data')`, and an import map to `https://esm.sh/react@18`, but nothing that exfiltrates data by itself.
Filesystem reach	1 (low)	The Node guide shows file writes and deletions like `writeFile('./output.txt', ...)` and `rm('./temp', { recursive: true, force: true })`, but only in scoped example paths.
Secrets & credentials	1 (low)	Examples touch secret-like data (`process.env.API_KEY`, `sessionStorage.setItem('token', '<token>')`), but the skill does not directly read keychains, dotfiles, or credential stores.
Privilege & persistence	0 (none)	There is no `sudo`, global install, service registration, shell startup editing, or OS-level configuration change in the skill files.
Instruction hijack surface	0 (none)	No hidden instructions, instruction-bypass text, or requests to ignore the agent’s rules appear in the files.
Irreversible actions	0 (none)	The skill guides local implementation and validation only; it does not push, deploy, message, pay, book, or otherwise act outside the repo.
Transparency	0 (none)	All shipped files are plain, readable Markdown; there are no binaries, encoded blobs, or downloaded installers.

Before installing

Read `SKILL.md` and decide whether you are comfortable with the agent running `eslint --fix` and Jest in your repo.
Check your project’s lint/test scripts for postinstall hooks, network calls, or destructive file operations before letting it run.
Try it first in a scratch repo or with dummy `.env` values if your project uses API keys or tokens.
Confirm you’re okay with generated code using `fs/promises`, `child_process`, and `fetch` patterns if needed.

Rated 2026-10-20 by an automated review of 6 files from the skill's repository.

Source

Repository: Jeffallan/claude-skills (all skills from this repository)
Path: skills/javascript-pro/SKILL.md
Branch: main
Updated: 2026-09-19

cpp-pro — Writes, optimizes, and debugs C++ applications using modern C++20/23 features, template metaprogramming, and high-performance systems techniques.
embedded-systems — Use when developing firmware for microcontrollers, implementing RTOS applications, or optimizing power consumption.
vercel-react-best-practices — React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing.
dwarf-expert — Analyzes DWARF debug information in compiled binaries.
eas-observe — EAS service (paid). Use for anything related to EAS Observe - adding `expo-observe` to an Expo project (AppMetricsRoot/ObserveRoot HOC.
modern-cpp — Guides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++.