When should this skill be used?

Use it when reviewing HTML or JSX for anchor elements with target='_blank' to verify rel='noopener noreferrer' is present.

What does the skill check for?

It checks anchor elements with target='_blank' and verifies that rel='noopener noreferrer' is present, flagging any anchors where it is missing.

Does it work with both HTML and JSX?

Yes, the skill reviews anchor elements in both HTML and JSX code.

External Link Security

SkillDev tools

new-tab is a skill for AI agents that reviews HTML or JSX code for anchor elements using target='_blank'. It checks whether each such link includes rel='noopener noreferrer' and flags the ones that are missing it. This new Claude skill fits into code review workflows where link security attributes matter.

Use External Link Security in Claude, ChatGPT or Ahel Desktop

Free. Sign in, add External Link Security and connect your AI. About a minute.

Claude ChatGPT Ahel Desktop

Also: Claude Code · Cursor · Codex

Then ask your AI: use the External Link Security skill

Details

Instructions available. Your AI can read the instructions. Execution depends on the setup they require.

Account requirements not reviewed. Check the skill instructions before use; ahel provides instructions and does not run this skill.

No other account needed.

Have HTML or JSX files containing anchor elements with target='_blank' available for review.

External Link SecurityStart free

What your AI can do with it

Review HTML anchor elements that use target='_blank'
Review JSX anchor elements that use target='_blank'
Verify rel='noopener noreferrer' is present on each such anchor
Flag anchors that are missing rel='noopener noreferrer'

Getting started

Have HTML or JSX files containing anchor elements with target='_blank' available for review.
Add the new-tab skill to your agent's available skills.
Ask the agent to review the code for anchors missing rel='noopener noreferrer'.

What this skill tells your AI

The instructions your AI receives, as published by thedaviddias/front-end-checklist in skills/new-tab/SKILL.md and read by ahel’s review.

A malicious site opened via target='_blank' can use window.opener.location to silently redirect your original tab to a phishing page — the user switches back and sees a fake login screen on what appears to be your domain.

Quick Reference

Always add rel="noopener noreferrer" to any <a target="_blank"> link
noopener prevents the new tab from accessing window.opener and redirecting your page
noreferrer additionally suppresses the Referer header sent to the destination site
Modern browsers (Chrome 88+, Firefox 79+) implicitly add noopener for cross-origin _blank links, but explicit markup is required for older browsers and same-origin links
ESLint rule jsx-a11y/anchor-is-valid and eslint-plugin-security can enforce this automatically

Check

Find all anchor elements with target='_blank' in the HTML and JSX source. Verify each one includes rel='noopener noreferrer' (or at minimum rel='noopener'). Flag any external links opening in a new tab that are missing this attribute.

Fix

Add rel='noopener noreferrer' to all elements. In React/JSX this is rel="noopener noreferrer". Configure an ESLint rule to prevent this from recurring.

Explain

Explain the reverse tabnapping attack enabled by window.opener, how rel='noopener' and rel='noreferrer' prevent it, and the difference between the two values.

Code Review

Review server config, headers, forms, and integration points related to External Link Security. Flag exact responses, cookies, or browser behaviors that violate the rule, and verify them against the effective production-like response.

For full implementation details, code examples, and framework-specific guidance, see references/rule.md.

Rule page: https://frontendchecklist.io/en/rules/security/new-tab

Signals

GitHub stars: 74k
Forks: 7k
Last commit: Oct 2026
Hacker News mentions: 1

ahel review

K1binfo
installs-packages (in references/rule.md)

Automated review, not a security audit. Ruleset v1+k2.

Questions

When should this skill be used?: Use it when reviewing HTML or JSX for anchor elements with target='_blank' to verify rel='noopener noreferrer' is present.
What does the skill check for?: It checks anchor elements with target='_blank' and verifies that rel='noopener noreferrer' is present, flagging any anchors where it is missing.
Does it work with both HTML and JSX?: Yes, the skill reviews anchor elements in both HTML and JSX code.

Advanced

Item type: skill
Key: new-tab
Source: github.com/thedaviddias/front-end-checklist

github.com/thedaviddias/front-end-checklist