Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent browser graphics guidance package with no executable payload, persistence, credential access, or hidden high-impact behavior found.
Install this if you want agent guidance for browser graphics work. Expect it to influence rendering implementation choices and visual verification, but it does not appear to run code or access sensitive data on its own.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-canvas-threejs`
- Category: `implementation-capability`
- Version: `2.9.0`
- Source: `skills/fec-canvas-threejs/SKILL.md`
## Description
The README's trigger guidance is broad enough to match many common frontend terms such as Canvas, WebGL, Shader, 3D, data visualization, and games without strong activation boundaries. In an agent-routing system, this can cause the skill to be invoked in situations outside its intended scope, increasing the chance of inappropriate code generation or review behavior and expanding the attack surface for prompt/skill selection abuse.
The manifest text explicitly specifies 'Chinese triggers include Canvas, Three.js, WebGL, GLSL, Shader, 3D, data visualization, games,' which imposes a locale-specific trigger policy in natural language. The file does not indicate that language selection is optional or that equivalent triggers are offered by user choice.
No suspicious patterns detected.