Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward Storybook documentation skill with user-run setup examples, not hidden code or persistent behavior.
Install only if you want Storybook-focused component documentation help. Before copying commands, pin package versions where practical, run them in the intended project, and keep Chromatic tokens in environment variables or CI secrets rather than inline shell history.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-storybook-component-doc`
- Category: `design-ui`
- Version: `2.9.0`
- Source: `skills/fec-storybook-component-doc/SKILL.md`
## Description
The description says to use the skill for a very wide set of situations, including broad phrases like reviewing component documentation, design-system presentation, and broader Storybook-related topics. It also says Chinese triggers include generic terms such as "Storybook" and "Design System," which are common topic mentions and may overlap with ordinary discussion rather than a clear activation boundary.
This is a manifest file, so vague-trigger review applies. The description begins with "Use when setting up or reviewing..." followed by a long list of loosely related Storybook/UI activities, but it does not clearly define boundaries beyond one contrast with broader testing, which could cause the skill to match many ordinary frontend requests without precise trigger constraints or negative examples.
The documentation instructs users to run npx storybook@latest init, which pulls and executes code at install time from a moving target version. Using latest reduces reproducibility and increases supply-chain risk because a compromised or breaking upstream release could be executed immediately in the user's environment.
The command npx chromatic --project-token=<token> executes an unpinned package from the registry, exposing users to supply-chain compromise or unexpected behavior from upstream changes. Because this command also includes a project token, misuse could combine code-execution risk with CI or project-integrity exposure.
The example npx test-storybook runs an unpinned package version, so users may execute arbitrary install-time scripts or altered behavior from whichever version resolves at runtime. In documentation intended to be copied directly, this materially increases the chance of unsafe or non-reproducible execution.
The description explicitly states that 'Chinese triggers include Storybook, component documentation, Design System, visual regression,' which introduces a language-specific activation policy. Because the file does not offer a user language choice or explain a justified region-specific constraint, this appears to violate the language/locale policy requirement.
No suspicious patterns detected.