Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward frontend testing guidance skill with no hidden persistence, credential use, or unsafe behavior found.
Install this if you want help writing or reviewing frontend UI/component tests. Because the trigger text includes generic testing phrases, confirm it is being used for frontend component or UI-adjacent tests rather than broad test strategy, E2E, or validation-fix work.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-component-testing`
- Category: `testing`
- Version: `2.9.0`
- Source: `skills/fec-component-testing/SKILL.md`
## Description
The description says Chinese triggers include "unit testing" and "lightweight integration testing," which are broad phrases that can match many ordinary development requests beyond this specific frontend component-testing skill. The README does not provide clear activation boundaries, explicit trigger lists with constraints, or negative examples to distinguish when this skill should not be invoked.
The skill description uses broad trigger phrases such as 'component testing', 'unit testing', and 'lightweight integration testing', which are common terms that may cause the agent to invoke this skill in contexts where a different workflow would be more appropriate. Over-broad activation can degrade security and reliability by misrouting user requests, bypassing more specialized validation or planning workflows, and increasing the chance of incorrect or unsafe task execution.
The trigger text includes broad phrases such as "unit testing" and "lightweight integration testing," which can cause the skill router to activate this skill for many generic testing requests outside its intended frontend component/UI scope. Misrouting is dangerous because it can steer users away from more appropriate workflows (such as strategy, validation, or E2E) and produce incorrect or incomplete guidance for security- or quality-relevant tasks.
The description lists triggers such as "component testing" and especially "unit testing," which are broad phrases commonly used in everyday developer requests. Because the manifest does not provide explicit exclusion examples beyond a brief workflow preference note, the invocation scope may still be ambiguous and cause unintended activation.
The description explicitly states that Chinese triggers include several phrases, but it does not present this as an optional locale choice or explain a region-specific requirement. This can be interpreted as a language/locale policy issue because the file hard-codes language-specific invocation behavior without documenting user opt-in.
No suspicious patterns detected.