Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only frontend maintenance skill with coherent scope and no hidden execution, persistence, credential use, or data access behavior.
Installers should treat this as a low-risk guidance skill for legacy frontend maintenance. It may be selected for a fairly wide range of vanilla JS, jQuery, HTML/CSS, and multipage frontend work, so users who need modern framework migration, deeper security review, or validation workflows should choose a more specific skill for those tasks.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-legacy-web-standard`
- Category: `legacy-migration`
- Version: `2.9.0`
- Source: `skills/fec-legacy-web-standard/SKILL.md`
## Description
The README says to 'Use when maintaining or safely modifying existing non-framework frontend code' and then lists broad technologies and contexts, but it does not define specific invocation phrases, exclusions, or negative examples. This ambiguity could cause the skill to be selected for many ordinary frontend tasks beyond its intended legacy-maintenance scope.
The manifest description says the skill should be used when 'maintaining or safely modifying existing non-framework frontend code' and lists Chinese triggers such as 'traditional frontend' and 'native JS'. These phrases are broad and could overlap with many ordinary frontend requests, but the manifest does not provide explicit trigger boundaries or negative examples to clarify when this skill should not activate.
The description specifies 'Chinese triggers include traditional frontend, native JS, jQuery,' which introduces a language-specific trigger policy in natural language. There is no indication that language choice is optional or user-configurable.
The description is broadly scoped and includes multiple loosely bounded trigger conditions such as maintaining legacy frontend code, vanilla JavaScript, jQuery, HTML/CSS, MPA pages, and server-rendered templates. In an agent-skill ecosystem, this can cause over-invocation or ambiguous routing, which may lead the skill to activate in contexts beyond its intended specialty and produce unsafe or low-quality guidance for unrelated tasks.
No suspicious patterns detected.