Security audit
Security checks for vulnerabilities and agentic risk
This is a markdown-only frontend guidance skill for server-state data fetching patterns, with no hidden execution, persistence, credential access, or destructive behavior.
Install this as a coding-guidance skill if you want agents to apply TanStack Query/SWR-style server-state patterns. Review generated app code normally, especially mutation and optimistic-update logic, because those examples can affect your application's data if implemented incorrectly.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-data-fetching`
- Category: `implementation-capability`
- Version: `2.9.0`
- Source: `skills/fec-data-fetching/SKILL.md`
## Description
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
---
name: fec-data-fetching
description: "Use when implementing or reviewing frontend server-state flows: typed queries, request caching, invalidation, mutations, optimistic updates, infinite queries, prefetch, SSR hydration, or API-layer integration. Do not use for local UI state or Service Worker caching; Chinese triggers include data fetch, cache, optimistic updates."
---
# Server State data acquisition
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
---
name: fec-data-fetching
description: "Use when implementing or reviewing frontend server-state flows: typed queries, request caching, invalidation, mutations, optimistic updates, infinite queries, prefetch, SSR hydration, or API-layer integration. Do not use for local UI state or Service Worker caching; Chinese triggers include data fetch, cache, optimistic updates."
---
# Server State data acquisition
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
---
name: fec-data-fetching
description: "Use when implementing or reviewing frontend server-state flows: typed queries, request caching, invalidation, mutations, optimistic updates, infinite queries, prefetch, SSR hydration, or API-layer integration. Do not use for local UI state or Service Worker caching; Chinese triggers include data fetch, cache, optimistic updates."
---
# Server State data acquisition
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
---
name: fec-data-fetching
description: "Use when implementing or reviewing frontend server-state flows: typed queries, request caching, invalidation, mutations, optimistic updates, infinite queries, prefetch, SSR hydration, or API-layer integration. Do not use for local UI state or Service Worker caching; Chinese triggers include data fetch, cache, optimistic updates."
---
# Server State data acquisition
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
---
name: fec-data-fetching
description: "Use when implementing or reviewing frontend server-state flows: typed queries, request caching, invalidation, mutations, optimistic updates, infinite queries, prefetch, SSR hydration, or API-layer integration. Do not use for local UI state or Service Worker caching; Chinese triggers include data fetch, cache, optimistic updates."
---
# Server State data acquisition
The manifest description says the skill should be used for 'frontend server-state flows' and adds Chinese triggers including 'data fetch' and 'cache'. Those trigger terms are broad and could match many ordinary frontend conversations without clearly defining activation boundaries or exclusions beyond a partial list.
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- API functions are only responsible for requesting, parsing and error normalization, and do not include UI toast, loading or caching logic.
- The cache key/query key must contain all parameters that affect the response.
- Mutation fails by entity or list after success; optimistic update must save the snapshot first and roll back when it fails.
- Infinite queries only handle data paging; DOM virtualization is handled by the list virtualization process.
- Prefetching must have a clear user path or above-the-fold revenue, and do not request all possible data in advance.
## QueryClient default configuration
The description explicitly states 'Chinese triggers include data fetch, cache, optimistic updates,' which imposes a language-specific activation path. This is a natural-language policy concern because it hardcodes a locale/language behavior without offering a user choice or documenting a justified region-specific constraint.
The guidance throughout the file is written as prescriptive English-language instructions ('use TanStack Query', 'do not', 'must') without offering language or locale choice. Under the stated policy, forcing a specific language can be a natural-language policy violation unless the constraint is explicitly justified or optional.
No suspicious patterns detected.