Security audit
Security checks for vulnerabilities and agentic risk
This frontend design skill uses proportionate local tools, with a minor privacy caveat in its advice about saving form drafts.
Run the linter against the intended project paths. If you implement draft saving, make it visible and optional, exclude sensitive fields, and provide expiration and deletion controls. The skill otherwise requires no credentials or elevated access.
Without declared permissions the skill's intent is opaque and cannot be validated.
Suspicious Unicode normalization or mixed-script content
The wizard specification recommends persisting form drafts locally without limiting which fields are saved, defining expiration, or notifying users before persistence. If applied to sensitive forms, this can leave entered information accessible to subsequent users of a shared browser profile or to same-origin scripts; the general-purpose component context makes unsafe reuse plausible, although no actual sensitive-data storage implementation is shown.
The instruction requires every term to have a Chinese name plus an English name, regardless of the user's preferred language. Although it explains the usefulness of English implementation terminology, it does not justify requiring Chinese or offer a language choice.
