Security findings 5
Destructive action
criticalConfirmedmedium confidenceThe skill's reference page documents a pre-deployment script that recursively deletes debug, test, and spec files and removes .env configuration files, webpack config, and development directories across the repository, a destructive capability beyond the skill's declared purpose of reviewing HTML comments.
rm -f .env.local
vector:codevector:instruction
Counter-argument considered
The same agent-reachable script silently removes developer environment and config files (.env.local, .env.development, webpack.dev.js) plus test/spec files; deleting config and test files is undeclared by the markup-review skill, matches the detector's not-declared residue, and is not covered by any carve-out, so the finding stands.
Destructive action
highContextual riskmedium confidenceThe same undeclared pre-deployment script recursively deletes development directories and test files (.storybook/, __tests__/, coverage/, *.test.js, *.spec.js), destructive behavior beyond the declared removal of comments and debug code.
rm -rf .storybook/
vector:code
Counter-argument considered
SKILL.md points the agent to references/rule.md, where the pre-deployment script deletes test directories and source test files (.storybook/, __tests__/, coverage/); this destructive behavior is outside the declared review-and-flag scope, is not a build/cache-dir carve-out, and no mitigation exists, so the finding survives.
Code execution
highContextual riskmedium confidenceThe same pre-deployment script instructs the agent to execute scripts/cleanup-package-json.js, a file the shown skill content does not ship, so the agent would run whatever unknown code exists at that path at runtime.
node scripts/cleanup-package-json.js
vector:codevector:instruction
Counter-argument considered
The reachable pre-deployment script contains the concrete command 'node scripts/cleanup-package-json.js', which makes the agent execute whatever code exists at that path at runtime; the file is not shown in the skill content, executing it is undeclared by the review-and-flag scope, and no installer/registry carve-out applies, so the finding stands (shipping status affects only severity, so a request is added for the script).
Code execution
highContextual riskmedium confidenceThe rule.md file that SKILL.md directs the agent to for 'full implementation details' presents a runnable Node.js cleanup script ('scripts/remove-debug-code.js') under 'Automated Cleanup Scripts' which, when invoked via processDirectory('./src'), reads and rewrites every .js/.jsx/.ts/.tsx file in the tree in place, regex-stripping console.log, debugger, and TODO/FIXME/DEBUG content — mass source-file mutation targeting JavaScript/TypeScript far outside the declared HTML-comment review scope.
processDirectory('./src')vector:instruction
Counter-argument considered
The agent-directed rule.md ships a self-executing Node script under 'Automated Cleanup Scripts' that ends in processDirectory('./src') and rewrites every .js/.jsx/.ts/.tsx in place via regex deletion; mass source mutation contradicts the declared scope of reviewing markup and flagging violations (validating browser-facing output, not mutating source frameworks), with no carve-out or mitigation, so the finding stands.
Destructive action
highContextual risklow confidenceThe documented HTML cleanup script rewrites every glob-matched HTML file in place and removes any element whose class attribute merely contains the substring 'debug' or 'temp' (which also matches legitimate names like 'template-*'), silently destroying valid markup without backup.
const debugElements = document.querySelectorAll('.debug, .temp, [class*=vector:instruction
Counter-argument considered
The documented HTML cleanup script rewrites every glob-matched HTML file in place (fs.writeFileSync(file, dom.serialize())) after removing any element whose class merely contains 'debug' or 'temp', which silently destroys valid markup such as template-* elements; this in-place rewriting is undeclared destructive behavior outside the declared validate-and-flag scope and no carve-out or mitigation applies, so the finding stands.
