Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple unit-test template generator with no hidden execution, network access, persistence, or sensitive-data handling.
Before installing, note that generic phrases like "unit test" or "generate test" may activate it more often than intended. It appears safe from a security standpoint, but generated tests should still be reviewed for correctness.
The natural-language instructions and headings are predominantly in Chinese, which can impose a language preference on users without explicit opt-in. No statement indicates that the skill is intentionally region-specific or that users may choose another language.
The trigger phrase "测试用例" is broad enough to appear in ordinary conversation about testing, which can cause accidental skill activation outside a clear invocation context. While this is not directly exploitable as code execution, it can lead to unintended behavior, prompt-routing mistakes, or invocation of the wrong capability.
The English trigger phrases "unit test" and especially "generate test" are ambiguous and likely to match normal discussion, documentation, or user intent unrelated to invoking this exact skill. This increases the chance of false activations and unreliable routing, which can degrade system safety and predictability.
The trigger patterns are broad enough to activate on generic requests such as 'unit test' or 'generate test', which can cause the skill to intercept unrelated user prompts outside a clearly scoped context. In an agent environment, overbroad routing can lead to unintended execution paths, incorrect tool selection, or application of this code-generation behavior when the user did not explicitly request this specific skill.
This file presents activation and behavior text in both Chinese and English, but it does not explain whether the skill is intended to operate bilingually or how language choice is determined. That can create an implicit language-policy issue if the skill behavior depends on language without an explicit user opt-in or documented locale scope.
No suspicious patterns detected.
