Security audit
Security checks for vulnerabilities and agentic risk
This skill is a documentation-only QA context-packaging helper with disclosed file/URL reading behavior and no bundled executable code or persistence.
Installers should treat the npx command for the broader skill set as optional and verify its source/version before running it. Users should also confirm the desired language and only provide files or URLs that are relevant to the QA context package.
The trigger phrases include very broad natural-language terms such as '上下文工程', '构建上下文', and '上下文不够', which can match ordinary conversation and cause the skill to activate outside its intended scope. Unintended activation can pull in file reads or web fetches and steer workflow decisions based on the wrong skill, increasing the chance of data over-collection or inappropriate tool use.
The when-to-use field describes invocation boundaries loosely, relying on broad examples rather than strict eligibility rules. In agentic systems this ambiguity can cause the skill to be selected when the user is merely discussing context, leading to unnecessary reads/fetches or bypassing more appropriate upstream analysis skills.
The skill recommends installing or invoking tooling via npx skills add Kokxi/qa-test-skills without pinning an exact version or immutable source. That creates a supply-chain risk: future package updates, account compromise, or dependency substitution could cause users to execute unexpected code when following the instruction.
The entire template, headings, instructions, field labels, and checklist are written as mandatory Chinese content, implying the skill output/package should be produced in Chinese by default. There is no statement that the language is optional, configurable, or justified by a region-specific use case, which makes this a natural-language locale policy concern.
The entire skill reference is written as a prescriptive operating guide in Chinese, with no indication that language is configurable or optional. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless clearly justified as region-specific, which is not stated here.
The file presents the primary description and operational guidance in Chinese while appending an English activation sentence, but it does not state how language should be chosen based on user preference. This can lead to inconsistent language behavior and a locale mismatch for users who did not opt into Chinese or bilingual operation.
