Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-style frontend workflow skill with some broad activation wording but no hidden execution, data access, persistence, or credential handling.
This skill is reasonable to install for frontend responsive-layout help. Be aware that its broad trigger words and implicit invocation may cause it to activate for general frontend or layout requests, so review whether that behavior matches your routing preferences.
The trigger sentences are broad and generic enough that the skill may activate for loosely related requests instead of only clearly scoped mobile-responsiveness tasks. In an agent system, ambiguous activation can cause tool/skill misuse, unexpected instruction precedence, or inappropriate handling of user requests, which expands attack surface even if the content is not overtly malicious.
The trigger phrases are broad and include generic terms like 'layout', 'frontend', and natural-language invocations that could match many unrelated user requests. This can cause the skill to activate outside its intended scope, leading to inappropriate routing or unintended influence over conversations, though it does not itself enable direct code execution or data exfiltration.
The trigger keywords are broad enough to match many ordinary frontend requests, which can cause the skill to activate when the user did not intend it. Unintended invocation can route conversations into this skill's workflow unnecessarily, reducing reliability and potentially causing incorrect or irrelevant guidance to be produced.
The example trigger uses a very general phrase structure that resembles everyday user requests, increasing the chance of accidental skill invocation in unrelated contexts. This weakens routing precision and can create noisy or misleading activations across normal frontend support conversations.
文件以 SKILL.zh-CN.md 形式提供中文（中国）版本内容，但文中未说明这是可选语言界面，也未向用户提供语言/区域选择。根据规则，若技能隐含强制特定语言或 locale 且无用户 opt-in，属于自然语言政策问题。
L04 使用“当用户提出…或需要围绕该需求获得实用流程、产物、检查清单、分析或实现支持时使用”来描述触发条件，但未说明哪些请求不应触发，也未界定 creative-and-content 与布局修复之间的关系。这会使调用范围显得过宽，难以区分普通内容协作请求与真正的移动响应式修复需求。
L44 将 layout、frontend、responsive design 等常见术语直接列为关键词，但未限定具体上下文、使用边界或排除条件。这些词在普通网页开发对话中非常常见，容易让技能在并非需要该专门工作流时被触发。
The default prompt is phrased in broad, natural language and includes generic terms like "help me" and a wide problem description, which can cause the skill to be invoked in situations beyond the author's intended scope. When combined with implicit invocation, this increases the chance of unintentional routing of user requests into this skill, creating prompt-scope confusion and potentially exposing users to irrelevant or unsafe automated behavior.
Enabling implicit invocation without clear trigger constraints allows the platform to auto-select this skill based on loosely related requests. In practice, this can cause unintended activation on ambiguous user input, leading to overbroad behavior selection, interference with other safer or more appropriate skills, and reduced user control over which automation is running.
The trigger sentences use broad natural-language phrasing such as "Help me" and "I need a practical workflow," which can match ordinary user requests that were not meant to invoke this specific skill. In an agent environment, that increases the chance of unintended or over-eager activation, causing irrelevant execution, context confusion, or accidental chaining into other actions.
This file is presented as a Chinese-language README, but key operational text and trigger phrases are written only in English. That can effectively force a specific language for use without documenting user choice or opt-in, which may violate language/locale policy expectations.
No suspicious patterns detected.
