Security audit
Security checks for vulnerabilities and agentic risk
This is a QA test-execution observation guide with disclosed log and data inspection guidance and no hidden code, persistence, or exfiltration behavior.
Install this skill if you want a Chinese-language QA execution observation workflow. Be cautious with the optional `npx skills add Kokxi/qa-test-skills` companion install unless you trust that source and version, and run any log, database, monitoring, or screenshot checks only in an authorized test environment.
The user-facing description and operational guidance are presented entirely in Chinese, and the file does not state that language selection is optional or region-specific. This creates a natural-language policy concern because the skill effectively assumes a specific language without explicit user opt-in.
The manifest lists generic activation phrases such as "测试执行", "执行异常", and "观察日志" without clear constraints or exclusion conditions. These terms are broad enough to match many ordinary QA conversations, which could cause unintended invocation of the skill.
The condition includes both exact phrases and broad descriptions like "需要执行测试观察" and "需要分析执行过程异常时", but does not explain what distinguishes this skill from adjacent QA skills. Without explicit boundaries, the invocation criteria remain unclear and may overlap heavily with normal QA assistance requests.
The skill instructs users to install a package via npx skills add Kokxi/qa-test-skills without pinning a version or commit. This creates a supply-chain risk: future package updates, package takeover, or dependency compromise could cause different code to execute than what was reviewed.
This markdown skill file uses only Chinese for headings, instructions, examples, and checklists. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can exclude users and should be flagged unless the locale restriction is explicitly justified.
This markdown file contains user-facing instructional content solely in Chinese and does not offer an alternative language or note that the skill is intentionally region- or language-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
