Security audit
Security checks for vulnerabilities and agentic risk
This is a frontend TDD guidance skill with no executable payload or hidden high-risk behavior.
Install this if you want the agent to follow a test-first frontend workflow. Expect it to propose or create behavior tests before implementation; if your task is styling-only, documentation-only, backend-only, or pure refactoring, tell the agent not to use this workflow.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-tdd-workflow`
- Category: `testing`
- Version: `2.9.0`
- Source: `skills/fec-tdd-workflow/SKILL.md`
## Description
The description says to use the skill for implementing new observable frontend behavior or fixing behavior-changing bugs across components, hooks, utilities, API clients, route guards, and user workflows. Although domain-related, this activation scope is very broad and lacks explicit negative examples or narrow invocation phrases, which could lead to unintended invocation for many routine frontend requests.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Prioritize component interaction Testing Library / Vue Test Utils.
- Prioritize critical processes across pages Playwright/Cypress.
3. Run the test and confirm that the failure reason is correct and should come from behavior that has not yet been implemented, rather than a syntax, import, or test environment error.
4. Write the minimum implementation that can just pass the test, and do not expand the scope easily.
5. Rerun the test and confirm it turns green.
6. Refactor naming, boundaries and duplication logic while keeping tests passing.
7. Fix bugs and retain regression tests that can reproduce the problem.
The instruction requires the agent to output minimum test implementation suggestions first and only then ask for confirmation. This prescribes a fixed interaction behavior that may override user preferences about when to receive guidance versus when to be asked, creating a mild natural-language policy concern around user choice.
This is a manifest file, so vague-trigger review applies. The description says to use the skill for implementing new observable frontend behavior or fixing a behavior-changing bug across a wide range of targets, but it does not define explicit trigger phrases, invocation constraints, or negative examples, which could lead to unintended activation during common frontend work.
No suspicious patterns detected.