Security audit
Security checks for vulnerabilities and agentic risk
This is a plain accessibility review skill with no executable code, network behavior, credential handling, or hidden persistence observed.
Install this only if you want an agent to assist with frontend accessibility audits. Expect it to inspect relevant UI/code paths and possibly create a local report under reports/. Its trigger wording is broad, so users who only want explicit audit invocation may prefer tighter activation metadata, but no malicious or high-impact behavior was found.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-accessibility-check`
- Category: `review-quality`
- Version: `2.9.0`
- Source: `skills/fec-accessibility-check/SKILL.md`
## Description
The description says to use the skill when reviewing or improving a wide range of frontend accessibility topics, but it does not define specific trigger phrases, scope limits, or exclusion conditions. This broad natural-language activation guidance could overlap with many general frontend review requests and lead to unintended invocation.
Line L03 says to use the skill when "reviewing or improving frontend accessibility" and lists broad terms like "accessibility" and "WCAG" as triggers. These phrases can occur in many ordinary frontend discussions, and the file does not provide exclusion conditions or negative examples to clarify when the skill should not activate.
The description includes very broad trigger terms such as 'accessibility', 'a11y', 'WCAG', and 'screen reader', causing the skill to activate for a wide range of frontend-review prompts. Overly broad activation in a manifest is a real quality/security concern because it can make the agent invoke this skill unnecessarily, increasing prompt-surface exposure and potentially displacing a more appropriate skill.
The package description says to use the skill when reviewing or improving a wide range of frontend concerns and includes generic trigger terms like "accessibility" without any limiting context or exclusion conditions. In a manifest file, this can create ambiguous activation scope and increase the chance of unintended invocation during ordinary accessibility-related discussion.
Line L03 explicitly defines "Chinese triggers" for activation, which imposes a language-specific behavior without stating that language selection is optional or user-controlled. This can violate language/locale policy expectations when no opt-in or broader language choice is documented.
The description explicitly states that Chinese triggers include certain terms, but it does not present this as an optional locale setting or explain a region-specific need. This introduces a language-specific policy choice in natural-language metadata without user opt-in.
No suspicious patterns detected.