Security audit
Security checks for vulnerabilities and agentic risk
This is a read-only QA thinking aid with disclosed limits; the main cautions are broad trigger wording and an optional unpinned install command for a larger skill set.
Installing this skill is reasonable if you want Chinese QA review prompts. Be aware it may activate from broad phrases like “你怎么看” or “这样够吗”; run it only in testing or requirement-review contexts. Do not paste real customer, payment, ID, or production data, and verify the larger `Kokxi/qa-test-skills` package before running the optional `npx` install command.
The skill content, trigger descriptions, inputs, outputs, and operational guidance are written entirely in Chinese, while the display name is in English and no opt-in or locale justification is provided. This can amount to an implicit language policy constraint because users are not told they may choose another language or that the skill is region-specific.
The description lists broad triggers such as "你怎么看", "这样够吗", and "还有什么", which are common conversational phrases that could appear in many unrelated contexts. Because the trigger scope is not tightly constrained, the skill may activate unintentionally outside the intended requirement-analysis/testing domain.
The manifest says to use the skill when the user says broad phrases like "你怎么看" or whenever "需要怀疑和深度分析时", but it does not define what contexts qualify or exclude unrelated uses. This makes invocation criteria subjective and increases the chance of accidental triggering.
The skill instructs users to run npx skills add Kokxi/qa-test-skills without pinning an exact package/version. That creates a supply-chain risk: a future malicious or compromised release could be fetched and executed implicitly at install time. In this context the danger is somewhat reduced because the file itself does not auto-execute the command, but it still normalizes unsafe installation guidance inside a skill artifact.
