Security audit
Security checks for vulnerabilities and agentic risk
This skill provides web-accessibility and automation-readiness guidance with expected, disclosed code and spec-writing workflows.
Install this if you want an agent to audit or improve web pages for accessibility, structured data, scraping, and automation. Review proposed code edits before applying them, and ask it to show or confirm the spec file content before writing if you want tighter control.
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
<Head>
<script
type="application/ld+json"
dangerouslySetInnerHTML={{
__html: JSON.stringify({
"@context": "https://schema.org",
"@type": "Article",
The README lists broad trigger examples such as SEO, structured data, data-testid, scraping, and a11y audit, which are common phrases that can appear in many benign web-development conversations. In a skill-loading or auto-triggering environment, overly generic activation cues can cause unintended invocation of this skill, exposing unrelated user content to additional processing and producing inappropriate modifications or recommendations.
In this markdown file, the listed triggers include broad phrases such as "agent-friendly," "scraper-friendly," and "a11y audit," followed by "etc.", which leaves the activation scope open-ended. These terms can match a wide range of ordinary developer requests and the file does not provide negative examples or constraints clarifying when the skill should or should not activate.
The README lists broad trigger phrases such as improving SEO, adding structured data, crawler-friendly, and accessibility audit, which are common requests that may arise outside the intended security boundary of this skill. In agent-skill ecosystems, overly broad activation language can cause the skill to be invoked unexpectedly, increasing the chance it influences unrelated tasks or processes untrusted content in contexts the user did not intend.
The trigger phrases are broad enough to match common requests like SEO improvement, accessibility audits, and structured data changes, which can cause the skill to activate in situations the user did not specifically intend. That increases the chance of unexpected file reads, URL fetching, or code modification workflows being invoked under an overly generic request surface.
The skill instructs generating and writing agent-friendly-spec.md into the workspace without an explicit warning, confirmation step, or safer read-only default. In an agent environment, silent file creation can surprise users, alter repositories unintentionally, and be chained with broad triggers to cause unauthorized workspace modifications.
このファイルは日本語版 README ですが、L01 は日本語版を強調表示しており、本文全体も日本語のみで記載されています。利用者への言語選択や既定言語の説明自体はありますが、この版単体では日本語利用を前提にしており、言語選択の案内が十分に明示されていないと読めます。
L01 将当前文档明确设为“简体中文”版本，虽然同时提供英文和日文链接，但文件内未用自然语言说明技能运行时是否尊重用户语言偏好或允许选择输出语言。若该描述被视为技能说明的一部分，可能被理解为默认施加语言约束。
No suspicious patterns detected.