Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only skill for responsive layout help, with broad activation wording but no hidden code, credential use, persistence, or destructive behavior.
Install this if you want a lightweight responsive-design workflow helper. Be aware that it may activate on broad frontend or layout phrasing, so use the explicit skill name when you want it and review routing if your environment has many UI-related skills.
The trigger sentences are broad, natural-language phrases that a normal user could say outside an intentional skill invocation flow. This raises the risk of unintended activation, causing the agent to apply this skill in contexts where the user did not explicitly request it, which can override other routing logic or produce irrelevant guidance.
The trigger phrases are broad and map to common frontend terms such as 'layout', 'responsive design', and 'frontend', which can cause the skill to activate in situations where the user did not explicitly request this workflow. Unintended invocation is dangerous because it can override more appropriate skills, inject irrelevant guidance, or increase the chance that downstream skill behavior is applied to the wrong task context.
The trigger list includes broad generic terms such as "layout" and "frontend" that commonly appear in unrelated user requests. This can cause the skill to activate outside its intended scope, leading to incorrect routing, over-application of the skill, and reduced trust in agent behavior; while not directly enabling code execution or data exfiltration, it is a genuine security/quality control issue because overly broad invocation expands the skill's influence unexpectedly.
The example trigger sentences use vague natural-language patterns like "Help me..." and "I need a practical workflow..." around a broad requirement statement, which increases the chance of accidental invocation during ordinary conversation. In this skill's context, that makes the routing boundary less precise and can cause the agent to select this skill when a user did not actually request responsive-design assistance.
The invocation description is written so broadly that it could apply to a large class of general design, layout, or content-related requests. Ambiguous use conditions make accidental routing more likely, which expands the attack surface by allowing the skill's embedded instructions to influence conversations where they are not necessary.
The trigger keywords are broad enough to match many ordinary frontend or UI-related requests, which can cause this skill to activate outside its intended scope. Over-broad activation increases the chance of unintended instruction injection into unrelated conversations and can bypass more appropriate, narrowly scoped skills.
The trigger sentences are broad enough that ordinary user phrasing about help or practical workflows could invoke this skill without clear boundaries. Over-broad activation can cause unintended routing, irrelevant execution, or make it easier for adversarial prompts to steer the agent into using this skill in contexts it was not designed for.
The file presents separate English and Chinese documentation variants, but does not explicitly state that the user can choose their preferred language or locale during use. Because language handling is described in natural language and could imply a fixed-language experience, this may conflict with language/locale choice expectations.
Several evidence entries are presented in Chinese, but the document does not explain any language or locale expectations for users or whether multilingual content is intentional. This can create an implicit language/locale constraint without documented opt-in or justification.
No suspicious patterns detected.
