Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only monorepo guidance skill with no hidden execution, credential access, or persistence behavior found.
Install only if you want agents to apply pnpm/Turborepo/Nx monorepo conventions. Be aware that broad trigger words like workspace may make the skill activate during general repository discussions, but the inspected artifact does not contain executable code or hidden access behavior.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-monorepo-project-standard`
- Category: `project-standard`
- Version: `2.9.0`
- Source: `skills/fec-monorepo-project-standard/SKILL.md`
## Description
Line L14 says to use the skill when "creating, reviewing, or restructuring frontend monorepos" and lists broad triggers such as "monorepo" and "workspace." These terms are common in everyday engineering discussion and the file does not provide narrower trigger phrases, constraints, or negative examples to prevent unintended invocation.
The description explicitly states 'Chinese triggers include monorepo, workspace, multi-package,' introducing a language-specific activation policy. The file does not offer alternative language options or explain that the skill is limited to a Chinese-specific context, which can conflict with organizational language/locale neutrality requirements.
The activation description is broad enough to match many ordinary frontend or repository-related requests, which can cause the skill to trigger outside its intended scope. Over-broad triggering increases the chance that policy or workflow guidance is injected into unrelated tasks, leading to incorrect automation decisions or unnecessary influence over the agent's behavior.
The skill description uses very broad activation terms such as 'creating, reviewing, or restructuring frontend monorepos' plus generic keywords like 'monorepo' and 'workspace', without clear scope boundaries or exclusions. This can cause over-invocation in unrelated contexts, increasing the chance that the skill is applied to prompts it was not designed to handle and thereby expanding its influence over agent behavior.
Singling out Chinese triggers without explaining equivalent handling for other languages creates an unnecessary language-specific activation rule. This can produce inconsistent routing behavior, unfairly broaden triggering for one language, and make skill selection less predictable across multilingual inputs.
The description includes 'Chinese triggers include monorepo, workspace, multi-package' without stating that multilingual triggering is user-driven or opt-in. This can broaden automatic activation across languages unexpectedly, causing the skill to engage when the user did not clearly intend to invoke monorepo-specific guidance.
No suspicious patterns detected.