Security audit
Security checks for vulnerabilities and agentic risk
This is a low-impact responsive design helper with broad activation wording but no hidden code, persistence, credential access, or destructive behavior.
Install only if you want a lightweight responsive-layout workflow helper. Be aware it may activate on broad frontend or layout wording, so explicit invocation with $mobile-responsive-layout-fixer is clearer.
The trigger sentence uses a very broad natural-language pattern ('Help me ...') that could match ordinary user requests and cause the skill to activate unintentionally. Unintended invocation can route unrelated conversations into this skill's workflow, producing confusing behavior, bypassing more appropriate skills, or expanding the skill's influence beyond the user's clear intent.
This trigger remains ambiguous because it is framed as a common everyday request pattern ('I need a practical workflow for ...') without clear activation boundaries. Such ambiguity increases the chance of accidental firing from normal conversation, which can degrade routing integrity and make system behavior less predictable in multi-skill environments.
The trigger phrases are highly generic and closely resemble ordinary user requests about responsive design, layout, and frontend help. This can cause unintentional invocation of the skill in contexts where the user did not explicitly intend to use it, increasing the chance of prompt-routing collisions, incorrect tool selection, or overbroad activation across unrelated conversations.
The manifest says 'Use when a user asks for' followed by a wide set of topics, but it does not define exclusions or decision criteria for when this skill should not run. In agent systems, ambiguous activation logic can route ordinary design or content requests into this skill, creating misfires and increasing the attack surface for prompt/skill selection abuse.
The trigger list is broad and includes generic frontend terms like 'layout' and 'frontend', which can cause the skill to activate for many unrelated requests. Overbroad activation increases the chance that this skill is selected outside its intended scope, leading to irrelevant guidance, workflow hijacking, or accidental suppression of a more appropriate skill.
该技能文件整体以简体中文编写，并通过文件名 SKILL.zh-CN.md 指定了中文语言环境，但内容中未说明这是可选语言版本、也未向用户提供语言选择或说明地域性必要性。按照语言/区域政策，这种未显式提供 opt-in 的固定语言约束属于自然语言策略问题。
The usage condition in the description is vague and mixes broad topics with many artifact types ('workflow, artifact, checklist, analysis, or implementation support'), without defining clear boundaries for activation. In an agentic environment, ambiguous routing rules can misapply this skill to unrelated requests and degrade safety and predictability.
The trigger keywords are very broad, especially terms like 'layout', 'frontend', and 'responsive design', which commonly appear in ordinary web-development conversations. This can cause unintended activation of the skill in contexts where the user did not request this workflow, leading to scope confusion and reduced reliability of agent behavior rather than direct code-execution risk.
The trigger sentence is broad enough that ordinary user phrasing could unintentionally activate this skill outside a clearly scoped mobile-responsiveness request. That can cause incorrect routing, unexpected tool behavior, or the skill overriding a more appropriate skill, especially in systems that rely on trigger matching rather than strong intent disambiguation.
This trigger uses a generic request pattern ('I need a practical workflow for...') with insufficient scope controls, making it ambiguous and prone to accidental invocation from unrelated planning requests. In an agent environment, ambiguous triggers increase the risk of misfires, degraded reliability, and unintended handling of user requests by the wrong skill.
No suspicious patterns detected.
