Security audit
Security checks for vulnerabilities and agentic risk
This is a Markdown-only QA helper that guides test blind-spot review and does not show hidden execution, persistence, or data exfiltration behavior.
Install only if you want a Chinese-language QA blind-spot checklist. Keep its file reads scoped to the requirements and test cases you intend to review, and do not run the optional `npx skills add Kokxi/qa-test-skills` command unless you separately trust that package/source.
The trigger conditions are very broad (e.g., phrases like '还有什么没测到', '全面覆盖', '遗漏场景'), which can cause the skill to activate in routine QA discussion even when the user did not intend to invoke it. Unintended activation can alter agent behavior, consume extra context/tools, and bias outputs toward this workflow, reducing reliability and potentially exposing more repository context than necessary.
The manifest and document content are written entirely in Chinese and instruct operation in that language, but they do not state that the skill is region-specific or offer an opt-in choice for other languages. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the constraint is clearly justified.
The skill recommends installing a package via npx skills add Kokxi/qa-test-skills without pinning a specific version or immutable source. That creates a supply-chain risk: a later compromised or incompatible release could be fetched and executed at install time, and npx commonly runs package code during resolution/execution.
The entire reference file is written only in Chinese and provides all operational guidance exclusively in that language. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
