Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only TypeScript standards skill with no executable behavior, persistence, credential access, or hidden data flow.
Install this if you want general TypeScript project-standard guidance. Be aware that its trigger wording is broad, so it may be invoked for many TypeScript-related requests where a narrower framework-specific skill could be more precise.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-typescript-project-standard`
- Category: `project-standard`
- Version: `2.9.0`
- Source: `skills/fec-typescript-project-standard/SKILL.md`
## Description
The description says to use the skill when 'creating, configuring, reviewing, or debugging TypeScript project standards' across a very wide range of TypeScript topics, and then appends a broad list of trigger terms such as 'generics' and 'type narrowing'. These phrases overlap with common TypeScript discussion and lack clear boundaries or exclusion conditions, making activation scope ambiguous.
The skill description is extremely broad and overlaps with many ordinary TypeScript help requests, which can cause over-invocation and let this skill intercept tasks better handled by narrower framework- or repo-specific skills. In an agentic system, over-broad routing increases the chance of inappropriate context loading, policy bypass through misclassification, or unintended authority over adjacent tasks.
The description uses very broad activation criteria such as creating, configuring, reviewing, or debugging TypeScript standards across many contexts, which can cause the skill to be invoked outside its intended boundary. Over-broad routing increases the chance that a general TypeScript standards skill will override or interfere with more specialized skills, leading to incorrect guidance, missed security-relevant context, or unsafe changes in adjacent domains.
The package description defines a very broad activation scope spanning most common TypeScript project, typing, tsconfig, and API-shaping tasks. In an agent-skill ecosystem, this can cause the skill to trigger for many unrelated or more specialized requests, leading to inappropriate routing, over-collection of user context, or displacement of safer/more precise skills.
The README explicitly states 'Chinese triggers include ...' but does not present language handling as an optional user choice or explain a region-specific need. This introduces a locale-specific policy choice in the skill description without opt-in language.
The description explicitly states 'Chinese triggers include ...' and hard-codes a locale-specific trigger set, but does not indicate that language choice is optional or user-selected. This can be a natural-language policy concern because it introduces a language-specific invocation policy without documenting opt-in or a clear region-specific justification.
The natural-language text explicitly introduces 'Chinese triggers' but the listed phrases are English-only, which indicates inconsistent language handling and may imply a language/locale policy issue. This can confuse activation behavior and suggests a language constraint that is not clearly offered as user choice or justified.
No suspicious patterns detected.