Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent frontend migration guide with disclosed code-migration behavior and no hidden execution, credential access, persistence, or exfiltration.
Install this only for deliberate frontend modernization work. Review the generated migration plan before allowing code changes, especially in large legacy projects, because the skill is intended to guide real refactoring.
Referenced artifact was not completely inspected
2. Load [references/migration-strategy-and-mapping.md](references/migration-strategy-and-mapping.md), select a progressive or one-time rewrite strategy, and cla
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-legacy-to-modern-migration`
- Category: `legacy-migration`
- Version: `2.9.0`
- Source: `skills/fec-legacy-to-modern-migration/SKILL.md`
## Description
The description activates on broad phrases like 'legacy projects' and 'technology stack upgrades' without clearly defining scope boundaries, which can cause the skill to be invoked in situations beyond intentional frontend migration. In an agent environment, over-broad routing can lead to inappropriate guidance, unintended code changes, or unsafe automation on systems that only need routine maintenance rather than migration.
The README states that 'Chinese triggers include legacy projects, technology stack upgrades, jQuery migration,' which introduces a language-specific activation policy in natural language. Because the file does not indicate that trigger language is optional or that the skill is intentionally region-specific, this can violate the policy against forcing a specific language without user opt-in.
The description explicitly states "Chinese triggers include..." which introduces a language-specific invocation policy, but the file does not indicate that language support is optional, user-selected, or limited for a documented regional reason. This is a natural-language policy concern because it hard-codes a locale expectation rather than presenting multilingual support as opt-in.
The description explicitly states 'Chinese triggers include legacy projects, technology stack upgrades, jQuery migration,' which introduces a language-specific activation policy. The file does not indicate that other languages are equally supported, that Chinese is optional, or that the locale restriction is justified.
The manifest description states that 'Chinese triggers include legacy projects, technology stack upgrades, jQuery migration.' This introduces a language-specific trigger policy in natural language without saying the skill also supports other languages by choice or that Chinese is optional, which can violate language/locale neutrality expectations.
No suspicious patterns detected.