Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only frontend skill for list virtualization, with no hidden execution, persistence, credential access, or unrelated data handling.
Safe to install as a frontend guidance skill. Expect it to activate for large-list or scroll-performance discussions; users who want tighter routing may narrow the trigger text, but no sensitive access or hidden behavior was found.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-list-virtualization`
- Category: `implementation-capability`
- Version: `2.9.0`
- Source: `skills/fec-list-virtualization/SKILL.md`
## Description
The invocation text is broad enough to match generic requests about scrolling or list performance, which can cause the skill to activate outside its narrow intended scope. Over-broad activation increases the chance that implementation guidance is injected into unrelated contexts, leading to poor routing, unintended capability exposure, or confusing agent behavior.
The manifest description says 'Use when optimizing or reviewing large lists' and includes generic phrases like 'large list optimization' and 'scroll performance' without explicit boundaries or negative examples. These terms are broad enough to overlap with many ordinary frontend performance discussions, making unintended invocation more likely.
The manifest description says 'Use when optimizing or reviewing large lists' and then lists many related topics, but it does not define explicit trigger phrases, scope limits, or exclusion conditions. Terms like 'large lists' and 'scroll performance' are broad enough to overlap with common frontend discussions, which could cause unintended invocation.
The manifest description says "Use when optimizing or reviewing large lists" and then lists many related topics, but it does not define clear boundaries or exclusion cases for when the skill should not activate. This broad phrasing may overlap with ordinary frontend review requests involving lists or performance, making invocation scope ambiguous.
No suspicious patterns detected.