Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only frontend API/data-layer guidance skill with no code execution, persistence, or hidden data access.
Before installing, be aware that this skill is mainly written for Chinese-speaking frontend development workflows and may activate on broad API or loading-state terms. It appears safe from a security perspective because it is guidance-only and does not run code or access data.
The skill activates on a very broad set of common development terms such as requests, error handling, loading, caching, and data flow, without defining clear boundaries or exclusions. This can cause the skill to trigger in many unrelated conversations, increasing the chance it injects guidance or influences agent behavior outside its intended scope.
The trigger metadata uses very broad terms such as “请求” and “错误处理”, which are common in ordinary frontend discussions and can cause the skill to activate outside its intended scope. Over-broad activation can steer unrelated conversations into this skill’s workflow, producing inappropriate guidance or interfering with more relevant skills, though it does not directly enable code execution or data exfiltration.
The activation examples list broad scenarios but do not define when the skill should not be used, making invocation boundaries ambiguous. In a multi-skill agent, this increases the chance of false activation and misrouting, which can degrade reliability and lead to irrelevant or overly prescriptive advice in contexts that only partially match API/data-layer concerns.
The manifest name, tagline, and description are written entirely in Chinese, which effectively constrains the skill's natural-language interface/content to a specific language without documenting user choice or opt-in. Under the stated policy, language-specific behavior should either offer a language choice or clearly justify the locale restriction.
No suspicious patterns detected.
