Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only frontend state-management skill with broad but coherent activation wording and no hidden execution behavior.
Installers should expect this skill to influence frontend state ownership and store-selection decisions. Review its broad trigger wording if your environment has many overlapping frontend skills, but no artifact evidence shows hidden execution, data access, or persistence by the skill itself.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-state-management`
- Category: `implementation-capability`
- Version: `2.9.0`
- Source: `skills/fec-state-management/SKILL.md`
## Description
The README says to use the skill when 'choosing, implementing, reviewing, or refactoring frontend state ownership' across many technologies, which is a very wide activation scope. It also mentions 'Chinese triggers include state management, state ownership, store selection,' where phrases like 'state management' are broad and could overlap with many routine frontend discussions without clear exclusion criteria.
The manifest description says to use the skill when 'choosing, implementing, reviewing, or refactoring frontend state ownership' across a very wide set of frameworks and concerns, and also lists generic Chinese triggers like 'state management' and 'state ownership'. These phrases are broad enough to overlap with many ordinary frontend discussions, and the file does not provide explicit exclusion conditions or negative examples to narrow when the skill should or should not activate.
The manifest description says to use the skill when 'choosing, implementing, reviewing, or refactoring frontend state ownership' and lists generic triggers like 'state management' and 'state ownership'. These phrases are broad and commonly applicable across many frontend tasks, but the file does not provide explicit constraints, exclusions, or negative examples to clarify when this skill should not activate.
This manifest file is in scope for vague-trigger checks. The description says 'Use when choosing, implementing, reviewing, or refactoring frontend state ownership' across many frameworks and contexts, which is broad and does not define clear activation constraints or negative examples, increasing the chance of unintended invocation overlap with other frontend skills.
The description explicitly states 'Chinese triggers include state management, state ownership, store selection,' which introduces a language-specific activation policy. Because the manifest does not indicate that language selection is user-configurable or optional, this can conflict with language/locale neutrality expectations.
No suspicious patterns detected.