Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only frontend testing strategy skill with no executable code, persistence, credential use, or hidden data access.
Safe to install for frontend testing strategy planning. Users should treat it as planning guidance, not an automatic test runner or specialist replacement, and should keep activation scoped to frontend test-layer strategy discussions.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-testing-strategy`
- Category: `testing`
- Version: `2.9.0`
- Source: `skills/fec-testing-strategy/SKILL.md`
## Description
The manifest description says Chinese triggers include phrases like "test strategy," "test layering," "test plan," and "coverage matrix." Several of these, especially "test plan," are broad terms that can appear in ordinary discussion, and the file does not provide explicit negative examples or stricter activation constraints beyond a general usage note.
The description uses broad activation phrases such as "test strategy," "test plan," and "coverage matrix" without strong boundaries, which can cause the skill to trigger in loosely related contexts. In an agent runtime, overbroad routing can misapply this skill, leading to inappropriate guidance, suppression of more suitable specialist skills, or user confusion during security- or quality-sensitive workflows.
The description explicitly states that 'Chinese triggers include test strategy, test layering, test plan, coverage matrix,' introducing a language-specific activation policy in natural language. There is no opt-in, alternative language-choice mechanism, or documented justification for this locale-specific behavior.
The natural-language description explicitly calls out 'Chinese triggers include test strategy, test layering, test plan, coverage matrix.' This introduces a locale/language-specific activation policy without stating that other languages are equally supported or that the limitation is intentional and justified.
No suspicious patterns detected.