Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward form-handling guidance skill with no executable code, persistence, credential access, or hidden behavior.
This skill is reasonable to install for complex frontend form work. Be aware that its trigger wording is somewhat broad, so it may activate on generic form-related requests; users or publishers may want to narrow the trigger description if precise routing matters.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-form-handling`
- Category: `implementation-capability`
- Version: `2.9.0`
- Source: `skills/fec-form-handling/SKILL.md`
## Description
The usage guidance says to use the skill for broad terms including "form" and the phrase "Chinese triggers include form," which are too generic and likely to overlap with ordinary conversation or many unrelated tasks. The description also lacks clear trigger constraints or negative examples for those trigger terms beyond excluding only trivial 1-3 field forms.
The manifest description states that 'Chinese triggers include form, form validation, dynamic fields' but does not offer an opt-in, alternative language handling, or justification for a language-specific constraint. This can create a language/locale policy issue because the skill behavior is partially keyed to a specific language without documented user choice.
The description contains very broad activation terms such as 'form' and 'form validation', which are common across many ordinary development requests. In skill-routing systems, this can cause the skill to be invoked outside its intended boundary, increasing the chance of irrelevant guidance, prompt-surface expansion, or accidental precedence over more appropriate skills.
The manifest description says the skill should be used for forms and notes Chinese triggers including "form" and related generic terms. In a manifest, such short and common trigger words are ambiguous and could match many unrelated conversations, and the description does not provide explicit negative examples or a narrow activation context beyond a partial exclusion for trivial forms.
The README explicitly specifies "Chinese triggers" without indicating that language selection is optional or user-configurable. This can constitute a language/locale policy issue because it privileges a specific language behavior without documenting opt-in or a region-specific need.
The manifest explicitly calls out "Chinese triggers include ...", which introduces a language-specific behavior in the skill metadata. There is no indication that this language handling is optional, user-selected, or required for a region-specific purpose.
No suspicious patterns detected.