Security audit
Security checks for vulnerabilities and agentic risk
This is a read-only QA review skill for checking AI-generated test cases, with no bundled executable code or hidden privileged behavior.
Install this skill if you want a Chinese-language workflow for final QA review of AI-generated test cases. Before running the suggested npx command for the broader skill set, verify the Kokxi/qa-test-skills source and consider using a pinned version or trusted commit.
The description includes broad trigger phrases such as expert review, case review, correction feedback, and final review, which are common in normal conversation and can cause the skill to activate outside its intended scope. Unintended activation can steer the agent into an irrelevant workflow, producing incorrect outputs or exposing user data to unnecessary processing paths.
The skill metadata and invocation guidance are predominantly Chinese and imply Chinese-language interaction patterns without any user language preference check. This can degrade safety and reliability by causing the agent to switch languages unexpectedly, misinterpret user intent, or generate inaccessible output for users who did not opt into Chinese.
The when-to-use field relies on ambiguous activation conditions like '需要对AI输出进行质量把关' and generic review terms without strict boundaries. In routing systems, this can over-match many unrelated requests, causing workflow hijacking or accidental invocation of the skill in contexts that do not involve test-case expert review.
The skill instructs users to install a package via npx skills add Kokxi/qa-test-skills without pinning a specific version or immutable source. This creates a supply-chain risk: a future malicious or compromised release could execute unintended code or install altered skill content when users follow the instruction.
The file title and instructional text are entirely in Chinese and present the guidance as the canonical documentation for the mechanism, with no indication that other languages are supported or that Chinese is required for a specific regional/compliance reason. Under the policy, forcing a specific language without user opt-in or justification is a natural-language policy violation.
