Frontend Security Review

• Outcome: Pass
• Latest audit: Sep 27, 2026 · 3:48 AM UTC
• Version: 2.9.0

Overview

This is a frontend security review skill whose file reading and report-writing instructions fit its stated purpose, with only minor routing-scope caveats.

Install this if you want an agent to review frontend code for browser-side security risks. Be aware that an unscoped invocation may cause it to inspect the project’s frontend code, related tests, configuration, and dependency declarations, and it may save a markdown report under reports/. Use explicit target files or directories when you want a narrower review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

ations, third-party scripts and dependencies.
2. Search for high-risk patterns: `dangerouslySetInnerHTML`, `v-html`, `innerHTML`, `document.write`, dynamic script, unverified redirect, and plain text token.
3. Review by risk type: XSS, CSP, sensitive data, CSRF, dependencies, input validation, file upload, open redirection, authentication authorization and third-party scripts.
4. Use the boundary model to determine responsibility: The client can only improve the experience and reduce misuse. Authentication, authorization, upload trust and sensitive operations must be finalized by the server.
5. High-risk issues are marked as blocking merges; front-end verification can only improve the experience and cannot be used as the only security boundary.
6. Output a hierarchical security report; see [references/report-template.md](references/report-template.md) for the report format.

## Detailed reference

- Load [references/security-checklist.md](references/security-checklist.md) when XSS, CSP

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

## Constraints

- Don't bypass security mechanisms to facilitate development.
- Don't rely on front-end validation as your only line of security.
- Do not trust any data coming from the client.
- High-risk issues must be marked as blocking merges when found.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 10)May include surrounding context.

md

- ID: `fec-security-review`
- Category: `review-quality`
- Version: `2.9.0`
- Source: `skills/fec-security-review/SKILL.md`

## Description

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description says to use the skill for many broad frontend security topics and then lists trigger phrases including generic terms like "security review" and "security check." These phrases overlap with common requests and the file does not provide clear scope boundaries, explicit invocation phrases, or negative examples to prevent unintended activation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description uses broad trigger phrases like 'security review' and 'security check', which are generic enough to match ordinary user requests outside a narrowly bounded frontend-security context. In an agent-routing system, this can cause over-invocation of the skill, leading to unintended data access or scope expansion during automated reviews.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill mandates a specific report format and grading style without offering user language or output-choice flexibility. While not a direct code-execution risk, forced output conventions can reduce transparency, create mismatches with user intent, and be abused to suppress clarifying interaction in multilingual or policy-sensitive contexts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This manifest file describes activation with broad terms such as "security review" and "security check," which are generic phrases likely to appear in everyday development conversations. Although the rest of the description narrows the domain to frontend security, it does not clearly delimit exact trigger phrases or provide exclusions, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description says the skill should be used for a wide range of frontend security topics and includes generic trigger phrases like "security review" and "security check." In a manifest file, these phrases are broad enough to match many ordinary requests and the description does not provide exclusion conditions or tighter invocation boundaries.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

User-specified scope takes precedence over the default. Use the following three review modes:

- **Change review**: only when recent changes, current edits, staged changes, a PR or a commit are explicitly requested or clearly established by the active task, review those changes and necessary context. For local changes, inspect staged and unstaged diffs and relevant untracked project files within the requested scope; a staged-only request reviews only staged changes. If there are no changes, report that there is nothing to review; do not switch to recent commits or expand scope automatically.
- **Targeted review**: when files or directories are specified, inventory and review existing code in that scope, including unchanged code; no Git diff is required.
- **Project review (default)**: when no scope or change context is specified, or when the entire project is requested, inventory project-owned frontend code, related tests, configuration and dependency declarations, then review in module batches, including unchanged code; no Git diff is required.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file contains user-facing instructional content only in English and does not indicate that alternative languages are available or that English is required for a specific justified context. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.