Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent testing-focused code review aid, with no evidence of hidden execution, persistence, exfiltration, or destructive behavior.
Before installing, confirm you want a Chinese-language testing-review workflow and avoid running the optional unpinned `npx` install command unless you trust the source or can pin and verify it. Expect the skill to read repository diffs and related code when asked to assess regression risk.
The activation wording is very broad, including common terms like code review, diff, and testing perspective, which increases the chance the skill is invoked in situations beyond its intended scope. Unintended invocation can expose unnecessary code context, trigger inappropriate tool use, or cause the agent to follow the wrong workflow during unrelated developer tasks.
The file’s description, metadata fields, and operational guidance are written as if the skill should be used in Chinese, with no indication that other languages are supported or that the user can choose a preferred language. This creates a locale/language constraint that is not presented as optional or justified as region-specific.
The when-to-use field uses ambiguous, overlapping phrases that lack scope boundaries, making accidental routing likely. In an agent system, ambiguous routing can cause the skill to process sensitive diffs or dominate other more appropriate skills, creating workflow confusion and potential data overexposure.
The skill instructs users to run npx skills add Kokxi/qa-test-skills without pinning a specific package version or immutable source. This can lead to supply-chain risk because a later compromised or maliciously updated package could be fetched and executed at install time.
