Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Markdown guide for generating FOSMVVM Leaf templates, with minor context-scope cautions but no hidden execution, persistence, or credential behavior.
Before installing, make sure you invoke this skill only when the current conversation and opened project files are relevant to the Leaf template you want generated. Review generated templates for correct data attributes, localization, and language settings before committing them.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
In templates, just use the property:
<span class="date">#(card.createdAt)</span>
<!-- Renders: "Dec 27, 2025" (localized) -->
If Localizable types render incorrectly (showing [ds: "2", ls: "...", v: "..."]):
The skill explicitly says it 'references conversation context automatically' and that 'no file paths or Q&A' are needed. In an agent setting, this can cause the model to incorporate ambient, unrelated, or attacker-seeded context without an explicit user opt-in, creating prompt-scope confusion and increasing the chance of unintended data use or manipulated output.
This section repeatedly instructs the agent to derive behavior from 'prior conversation', 'ViewModel code into context', and 'existing templates' discovered from codebase context. That broad implicit-context dependency is risky because it enables context poisoning and cross-task leakage: an attacker can shape earlier conversation or nearby files to influence generated output in ways the current user did not explicitly request.
The base layout sets <html lang="en">, which forces an English locale without indicating user choice or a documented region-specific requirement. This is a natural-language locale policy concern because it bakes a specific language setting into the generated template.
No suspicious patterns detected.