Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent bug root-cause-analysis skill with disclosed troubleshooting guidance and no hidden persistence, exfiltration, or destructive behavior found.
Install this only if you want a Chinese-language QA root-cause-analysis helper. Avoid pasting real production logs, customer data, payment details, identity numbers, or screenshots unless they are masked. Treat the optional `npx skills add Kokxi/qa-test-skills` command as a separate trust decision and verify the source before running it.
The trigger list includes generic phrases such as “定位问题” and “排查方向,” which are common in everyday troubleshooting and not specific to root-cause-analysis workflows. The description does not provide exclusion conditions or negative examples, so it is unclear when this skill should activate versus more general debugging or bug-reporting skills.
The metadata repeats broad activators like “定位问题,” “排查方向,” and “需要分析Bug根因,” but does not define required context such as recurrence, post-incident analysis, or systemic improvement goals. This can cause accidental invocation for routine debugging requests that are outside the intended scope.
The skill instructs users to install a package via npx skills add Kokxi/qa-test-skills without pinning an exact version or integrity, which creates a supply-chain risk. If the referenced package or its transitive dependencies are updated maliciously or unexpectedly, users may execute unreviewed code during installation or use.
The document content and usage instructions are entirely in Chinese, and it does not indicate that other languages are supported or that Chinese is required for a specific regional or compliance reason. Under the policy, language constraints should be optional or explicitly justified rather than implicitly enforced.
