Security audit
Security checks for vulnerabilities and agentic risk
This skill is a documentation-first frontend workflow that asks the agent to verify project facts and official sources, with no executable payload or hidden persistence.
Install this if you want the agent to favor project facts and current official documentation for frontend decisions. Expect it to read relevant project files and, when present or requested, a local knowledge directory; review those paths if they contain sensitive internal material.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-source-driven-development`
- Category: `maintenance-docs`
- Version: `2.9.0`
- Source: `skills/fec-source-driven-development/SKILL.md`
## Description
The activation text uses broad conditions like "Use when frontend decisions depend on" and includes generic trigger phrases such as "Check official documentation" and "source-driven" without clear boundaries or exclusion cases. In a README, this can overlap with common requests and make it unclear when the skill should or should not be invoked.
The listed trigger phrases include ambiguous natural-language terms like 'source-driven' and 'version differences,' which are common in benign discussion and may match unrelated prompts. In an agent skill system, ambiguous triggers widen the activation surface and can lead to misfires, making the agent follow this skill's process when it is not appropriate.
The listed trigger phrases include ambiguous natural-language terms like 'source-driven' and 'version differences,' which are common in benign discussion and may match unrelated prompts. In an agent skill system, ambiguous triggers widen the activation surface and can lead to misfires, making the agent follow this skill's process when it is not appropriate.
This is a manifest JSON file, so vague-trigger review applies. The phrase "Use when frontend decisions depend on framework, library, browser, runtime, package, API, or platform behavior that may have changed" is very broad and covers many routine frontend tasks, while the listed triggers are not clearly delimited or scoped with negative examples, increasing the chance of unintended invocation.
The package description says the skill should be used when decisions depend on behavior that 'may have changed' and lists trigger phrases like 'Check official documentation' and 'source-driven' without defining when the skill should not activate. In a manifest file, these broad phrases can overlap with ordinary engineering discussion and create ambiguous invocation scope.
The text states that "Chinese triggers include Check official documentation, source code shall prevail, source-driven, version differences," but the listed phrases are in English. This is a natural-language policy issue because it introduces unclear language expectations and may mislead users about supported locale behavior.
The natural-language text explicitly labels the following phrases as "Chinese triggers," but the phrases listed are English. This creates a language-policy inconsistency that could mislead routing or force an unintended locale expectation without clear user opt-in.
No suspicious patterns detected.