Security audit
Security checks for vulnerabilities and agentic risk
This is a read-only prompt-template skill for QA test-case generation, with some broad activation wording and an optional unpinned install suggestion users should treat carefully.
Install this skill if you want Chinese QA prompt templates for test-case generation. Before following the optional npx command for the larger skill set, review the source and prefer a pinned revision. Be aware that broad trigger phrases may make the skill appear for general prompt-optimization requests, so invoke it only when you are working on QA test prompts.
The description defines very broad trigger conditions such as '怎么问AI', '提示词', and 'AI回答不好', which can cause the skill to activate for many ordinary conversations unrelated to the intended workflow. Over-broad activation increases the chance of inappropriate prompt injection into unrelated tasks, bypassing user intent and potentially causing workflow hijacking or unsafe context propagation.
The when-to-use field uses ambiguous activation criteria like '需要不同测试视角' and 'AI输出太浅需要更深时' without defining boundaries, prerequisites, or non-applicable cases. In an agent environment, such ambiguity can cause accidental invocation and overreach, leading the skill to steer outputs or workflow steps even when the user did not request this behavior.
The skill includes an installation command using npx skills add Kokxi/qa-test-skills without pinning an exact package version or immutable source reference. This creates a supply-chain risk: a future compromised or maliciously updated package could be fetched and executed implicitly by users following the instruction.
The skill contains a dedicated section prescribing Chinese-model-specific adaptation strategies and Chinese-language prompting behavior without any opt-in or language preference check. This can override user expectations, leak assumptions about model/provider choice, and cause inappropriate transformation of prompts or outputs in multilingual or policy-sensitive environments.
The document title and instructional text are entirely in Chinese and present the prompt templates as the default interaction format, with no indication that users may choose another language. Under the policy, a skill that imposes a specific language without user opt-in is a natural-language policy concern.
