Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only responsive layout guidance skill with no code execution, persistence, credential access, or hidden behavior found.
This skill is reasonable to install for responsive frontend layout guidance. Be aware that its trigger description is broad, so it may be invoked for many responsive UI discussions, but the packaged content is limited to documentation and checklists.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-responsive-layout`
- Category: `design-ui`
- Version: `2.9.0`
- Source: `skills/fec-responsive-layout/SKILL.md`
## Description
Line L14 says to use the skill when "designing, implementing, or reviewing responsive frontend layouts" and then lists many related topics, but it does not define specific trigger phrases, boundaries, or exclusion cases. This broad natural-language scope could cause the skill to activate during ordinary frontend discussions rather than only when explicitly requested.
The trigger description is very broad and covers many common frontend activities, which can cause the skill to activate outside its intended scope. Overbroad activation can steer unrelated tasks into this skill's procedure and references, increasing the chance of incorrect guidance, tool misselection, or prompt-scope interference in agent workflows.
The description is broadly scoped and includes many common frontend activities such as designing, implementing, and reviewing layouts across devices. In agent-routing contexts, overly broad trigger language can cause the skill to activate for unrelated or only partially related tasks, increasing the chance of incorrect delegation, prompt-surface expansion, or interference with more appropriate skills.
The description explicitly specifies 'Chinese triggers include ...' but does not indicate that multilingual or Chinese-specific behavior is optional, user-selected, or required by a regional scope. This creates a locale-specific policy concern because the skill embeds language handling assumptions without documenting user choice or justification.
The text explicitly states 'Chinese triggers include ...' but does not clarify that language matching is optional or that other locales are equally supported. This can be interpreted as a locale-specific activation policy without documented opt-in or justification.
SQP-3 only applies to natural-language policy violations such as forcing a specific language or locale without opt-in. This file discusses responsive layout guidance and does not clearly impose a user-facing language or locale policy, so evidence for a violation is weak.
No suspicious patterns detected.