Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward documentation-sync helper that reads project source-of-truth files and updates docs, with no hidden execution, persistence, or credential behavior found.
Install this skill if you want an agent to compare documentation against project files and update public docs. Review resulting changes carefully, especially env variables, API behavior, deployment steps, and multilingual README updates, because the skill is designed to read those project facts and propagate them into documentation.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-doc-sync`
- Category: `maintenance-docs`
- Version: `2.9.0`
- Source: `skills/fec-doc-sync/SKILL.md`
## Description
The trigger phrases are overly broad and include common requests like "update README" and "docs sync," which can cause this skill to activate for generic documentation tasks outside its intended scope. In an agentic environment, unintended activation can route user requests into a workflow that inspects project files and modifies documentation based on inferred source-of-truth inputs, increasing the chance of inappropriate file access or unintended changes.
The trigger description contains broad phrases such as 'update README' and 'docs sync' that can match many ordinary user requests without clearly constraining when this skill should activate. Over-broad activation can cause the agent to invoke this skill in unintended contexts, leading to unnecessary repository scanning, unexpected documentation edits, or overshadowing more appropriate skills.
The description contains very broad invocation triggers such as 'update README', 'docs sync', and 'API Document synchronization', which can match many ordinary user requests without tightly scoping when this skill should or should not run. In an agent ecosystem, overbroad routing can cause this maintenance skill to activate on unrelated tasks and then read or propagate sensitive project facts from source-of-truth files into documentation or outputs.
The package description contains very broad trigger phrases such as 'update README', 'docs sync', and 'API Document synchronization', which can cause the skill to be invoked in situations outside its narrowly intended scope. In an agent ecosystem, over-broad activation increases the chance of the skill being selected for unrelated tasks, potentially exposing project files or causing unintended documentation modifications.
The description explicitly states that Chinese triggers include certain phrases, which introduces a language-specific activation policy. The file does not indicate that language selection is optional or that the locale restriction is required for a region-specific use case.
No suspicious patterns detected.