Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed frontend cleanup workflow that can delete proven-unused code but includes validation and risk limits.
Install this only if you want an agent to help remove unused frontend code. Review proposed deletions, especially routes, configuration, shared components, styles, dependencies, and public APIs, and rely on the requested verification steps before accepting changes.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-refactor-clean`
- Category: `review-quality`
- Version: `2.9.0`
- Source: `skills/fec-refactor-clean/SKILL.md`
## Description
The README says the skill should be used for broad cleanup tasks and lists trigger phrases such as "clean up unused" and "refactor clean," which are not narrowly scoped and could overlap with ordinary developer conversation. It also does not provide exclusion examples beyond a single behavior-based note, so activation boundaries remain somewhat ambiguous.
The description contains broad natural-language triggers such as 'dead code', 'clean up unused', and 'delete useless code', which are common phrases in normal developer conversation and can cause the skill to activate outside a tightly scoped cleanup request. In an agent setting, over-broad activation can route unrelated frontend tasks into a destructive refactor workflow, increasing the chance of unintended code deletion or dependency removal.
The line explicitly states that Chinese triggers include several phrases, which introduces a locale-specific behavior in the skill description. There is no accompanying opt-in, language choice, or justification that this skill is intended only for a Chinese-language context.
The description explicitly states that Chinese triggers include several activation phrases, which introduces a language-specific activation policy in the skill metadata. Because the file does not indicate that language selection is optional or user-configurable, this is a natural-language locale policy concern under the stated rules.
The description explicitly states that "Chinese triggers include..." but does not indicate that language selection is optional or that equivalent multilingual support is available by user choice. This creates a natural-language locale policy concern because a specific language behavior is prescribed without opt-in or justification.
No suspicious patterns detected.