Security audit
Security checks for vulnerabilities and agentic risk
This skill is a React and TypeScript project-structure guidance package with no hidden execution, persistence, credential use, or data exfiltration behavior.
Install this if you want opinionated React + TypeScript architecture conventions. Review the language preference for comments and the broad activation scope against your team's standards, but no security-relevant hidden behavior was found.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-react-project-standard`
- Category: `project-standard`
- Version: `2.9.0`
- Source: `skills/fec-react-project-standard/SKILL.md`
## Description
The invocation description says to use the skill when 'designing or reviewing' broad aspects of a React + TypeScript project structure, and adds generic Chinese triggers like 'React project specification' and 'React component architecture.' These phrases are wide in scope and lack explicit activation boundaries or negative examples, increasing the chance of unintended invocation for ordinary React discussions.
This is a manifest file, so vague-trigger checks apply. The description says to use the skill when 'designing or reviewing' a wide range of React architecture topics, which is broad and lacks clear activation boundaries or negative examples, increasing the chance of unintended invocation in general React discussions.
Lines L021-L024 instruct authors to 'Prefer using Chinese' for comments and say instructions can be in Chinese unless the repository requires English. This is a natural-language policy concern because it sets a default language requirement rather than offering a neutral choice or documenting a clear locale-specific justification.
The description explicitly introduces 'Chinese triggers' while the rest of the file is primarily in English, but it does not state that language selection is optional or user-driven. This creates a mild natural-language policy concern because the skill embeds a locale-specific trigger expectation without clarifying multilingual support or opt-in.
In this manifest file, the activation guidance says "Use when designing or reviewing React + TypeScript project structure" and similar broad conditions, but it does not define explicit trigger phrases or negative examples. This could cause unintended invocation because the scope overlaps with many common React architecture discussions rather than a narrowly bounded trigger set.
The description states "Chinese triggers include React project specification, React component architecture," which introduces a language-specific activation policy. Because the manifest does not indicate that language selection is optional or user-driven, this may violate language/locale neutrality expectations.
The manifest text explicitly states 'Chinese triggers include ...', which introduces a language-specific invocation path. Because the description does not clearly frame this as optional user choice or part of a justified locale-specific skill, it may conflict with language/locale neutrality expectations.
The example fallback UI hard-codes English strings ("Module loading failed", "Try again") in natural-language content. Because the file provides prescriptive guidance and does not mention localization or user locale choice, this can be read as forcing a specific language without opt-in.
No suspicious patterns detected.