Security audit
Security checks for vulnerabilities and agentic risk
This is a read-only QA boundary-analysis skill with a manual unpinned install suggestion that users should treat cautiously.
Before installing, use this for QA/test-design work and avoid pasting real customer, identity, payment, or production data. Do not run the suggested unpinned `npx skills add Kokxi/qa-test-skills` command unless you independently trust the publisher and are comfortable installing the broader skill suite.
The manifest content and operational instructions are written as Chinese-only guidance, with no indication that users may choose another language or that the locale restriction is intentional for a region-specific workflow. Under the stated policy, a language constraint should be optional or explicitly justified.
The trigger phrases in the description are broad everyday terms such as ‘边界分析’, ‘边界条件’, and ‘边界值’, which can appear in ordinary conversation outside the intended workflow. This can cause unintended activation of the skill, leading the agent to inject testing-specific behavior or instructions into unrelated tasks and reducing reliability and user control.
The when-to-use field defines ambiguous activation based on common phrases and a vague condition like ‘需要深入分析边界’, without clear guardrails. In an agentic environment, overly loose routing criteria can misfire, causing the wrong skill to run and potentially exposing unrelated user content to unnecessary processing paths.
The skill instructs users to run npx skills add Kokxi/qa-test-skills without pinning an exact package version or immutable source reference. This creates a supply-chain risk: a later package update or compromised upstream publication could cause users to install unexpected or malicious code when following the skill’s guidance.
This markdown file is natural-language content and appears to require Chinese comprehension throughout, from the title to all instructions and checklist items. Under the policy rule, forcing a specific language without user opt-in is a locale/language policy concern unless the regional constraint is explicitly documented and justified.
This markdown file contains natural-language instructions exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule, forcing a specific language without user opt-in is a locale-policy concern.
