Security audit
Security checks for vulnerabilities and agentic risk
This is a CI/CD testing guidance skill with disclosed, mostly advisory behavior and no evidence of hidden execution, persistence, exfiltration, or destructive actions.
Installers should treat this as an advisory CI/CD testing skill. Review the optional unpinned `npx skills add Kokxi/qa-test-skills` command before using it, and only apply any deployment or release recommendations in environments where you have explicit authorization and rollback plans.
The manifest description and when-to-use guidance are written as Chinese-only activation phrasing, which creates a natural-language locale constraint for skill invocation. The file does not indicate that this is a China-specific or Chinese-only skill, nor does it offer users an explicit language opt-in or alternative.
The skill instructs users to run npx skills add Kokxi/qa-test-skills without pinning an exact package version or immutable source. This creates a supply-chain risk because future package updates or a compromised upstream release could cause different code to be fetched and executed than the author originally intended.
The file states that the skill only writes evaluation files under workspace/, but later guidance discusses release, deployment, gray rollout, rollback, and production-adjacent operational actions. This mismatch can mislead operators about the skill’s real-world effect surface, causing unsafe trust decisions or use in more sensitive environments than intended.
The file title and instructional text are entirely in Chinese and provide no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language context. Under the policy rules, a fixed language requirement without opt-in or justification is a natural-language policy concern.
No suspicious patterns detected.
