Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese-language QA review skill that critiques AI-generated test cases and does not show hidden execution, persistence, exfiltration, or destructive behavior.
Install this if you want a Chinese-language review gate for AI-generated test cases. Be aware that it may activate on broad QA review phrases, and independently verify the optional npx install command before running it.
The skill description advertises activation on broad phrases like '检查一下输出', '验证完整性', and similar generic requests. This can cause the skill to trigger in unrelated contexts, unexpectedly steering conversations into critique workflows and influencing outputs when the user did not explicitly request this behavior.
The when-to-use metadata says the skill auto-activates after AI generates test cases and also on very broad user phrases, but it does not define strict boundaries or confirmation requirements. Ambiguous automatic activation can make the agent apply mandatory gating behavior in the wrong workflow, overriding user expectations and increasing the risk of unintended prompt hijacking through routine language.
The skill includes an install command using npx skills add Kokxi/qa-test-skills without any version pinning or integrity control. If the referenced package or resolution path changes, users may fetch unexpected code at install time, creating a supply-chain risk even though the command appears in documentation rather than as executable skill logic.
This section imposes Chinese-language-specific review behavior and checks for '国产模型' output patterns without any user opt-in or language negotiation. While not inherently malicious, it can override user language preferences, reduce usability, and create unexpected behavior in mixed-language or non-Chinese environments.
The file title and the entire report template are written exclusively in Chinese, which effectively constrains the skill's output language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
This markdown file presents all instructions and guidance exclusively in Chinese, with no indication that the user can choose another language. Under the policy rule for language/locale constraints, forcing a specific language without user opt-in is a natural-language policy concern.
This markdown reference file is entirely written in Chinese and frames the review process in that language as the default, without indicating that other languages are supported or that Chinese is required for a specific regional or compliance reason. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
