Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward development helper for running existing validation checks, fixing failures, and writing a local report, with no evidence of hidden persistence, exfiltration, or unrelated authority.
Install this only if you want the agent to run and rerun your project's existing lint, type-check, test, build, or CI-style commands and make code fixes. Review commands from unfamiliar repositories first, because project scripts can do more than validation.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- ID: `fec-validation-fix`
- Category: `review-quality`
- Version: `2.9.0`
- Source: `skills/fec-validation-fix/SKILL.md`
## Description
The invocation guidance uses broad phrases such as 'validation', 'check failures', and 'fix failures', which can overlap with ordinary troubleshooting requests and may cause unintended skill activation. Although one exclusion is provided for new component/E2E tests, the trigger scope is still not specific enough about what exact phrases or contexts should activate the skill versus not.
The manifest description lists trigger terms that are generic and widely used across normal development discussions, making it unclear when this skill should activate versus a more specific debugging or testing skill. Although some exclusions are given, there is no explicit bounded trigger list or negative examples for these broad phrases.
The skill explicitly instructs the agent to automatically execute existing verification commands, which creates autonomous action over repository-defined commands such as npm scripts or documented local scripts. In an adversarial or compromised repository, those commands can run arbitrary code, access secrets in the environment, or make unintended system changes without a separate trust check or user confirmation.
## Purpose
Automatically execute existing verification commands, analyze the reasons for failure and safely repair them to ensure that quality access control meets standards.
## Procedure
The package description says to use the skill for 'running existing project validation commands and fixing failures' across lint, type-check, tests, build, CI, and local script failures, and lists broad triggers like 'validation' and 'check failures.' In a manifest file, this lacks tight trigger boundaries or negative examples beyond excluding new component/E2E tests, so it could cause unintended invocation for many ordinary debugging or CI discussions.
The description explicitly states 'Chinese triggers include validation, check failures, fix failures, CI failures' but does not present language selection as optional or user-configurable. This can violate language/locale neutrality expectations when a skill imposes locale-specific behavior without opt-in.
The description states 'Chinese triggers include validation, check failures, fix failures, CI failures,' which introduces language-specific activation behavior. There is no accompanying indication that users can choose language behavior or that the locale constraint is justified, so this may violate language/locale policy expectations.
No suspicious patterns detected.