Security audit
Security checks for vulnerabilities and agentic risk
This is a frontend code review skill whose file reading and report writing are disclosed and proportionate to reviewing code.
Install this when you want broad frontend code review. Expect it to read project-owned frontend code, diffs, tests, config, and dependency declarations, and to write a report file; use specialized review skills for deep security, accessibility, E2E, or performance audits.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-code-review`
- Category: `review-quality`
- Version: `2.9.0`
- Source: `skills/fec-code-review/SKILL.md`
## Description
The line says to use the skill when the user asks for general frontend code review, PR review, merge-readiness, architecture maintainability, and other cross-cutting review requests. This scope is broad and lacks explicit constraints or negative examples, which increases the chance of unintended invocation from common review-related requests.
The description explicitly specifies Chinese triggers alongside English activation terms, but the skill does not state that language selection is optional or limited to a justified region-specific context. This creates a natural-language locale policy concern because activation behavior is being defined for a specific language without user opt-in.
Line L33 says to use the skill for 'general frontend code review' and a wide range of related requests such as PR review, merge-readiness, architecture maintainability, and cross-cutting review summaries. This trigger scope is broad and lacks explicit boundaries or negative examples, which could cause the skill to be invoked for many common review requests without clear constraints.
The manifest description uses very broad trigger language such as general frontend code review, PR review, merge-readiness, and cross-cutting review summary, which can cause the skill to be invoked for a wide range of requests without clear boundaries. In an agentic system, ambiguous routing increases the chance this skill handles tasks that should instead go to specialized security, accessibility, performance, or other review skills, leading to incomplete or misleading analysis.
The text explicitly states that Chinese triggers include certain phrases, which introduces a language-specific activation policy in the skill description. Because there is no accompanying statement that language choice is optional or user-driven, this can be interpreted as a locale-specific policy constraint without opt-in.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
User-specified scope takes precedence over the default. Use the following three review modes:
- **Change review**: only when recent changes, current edits, staged changes, a PR or a commit are explicitly requested or clearly established by the active task, review those changes and necessary context. For local changes, inspect staged and unstaged diffs and relevant untracked project files within the requested scope; a staged-only request reviews only staged changes. If there are no changes, report that there is nothing to review; do not switch to recent commits or expand scope automatically.
- **Targeted review**: when files or directories are specified, inventory and review existing code in that scope, including unchanged code; no Git diff is required.
- **Project review (default)**: when no scope or change context is specified, or when the entire project is requested, inventory project-owned frontend code, related tests, configuration and dependency declarations, then review in module batches, including unchanged code; no Git diff is required.
No suspicious patterns detected.