Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent exploratory-testing skill with no hidden execution or data exfiltration behavior, though users should treat its optional unpinned install command cautiously.
Install this skill only if you want structured exploratory QA guidance. Do not paste real customer, payment, identity, or production data into sessions. Verify or pin the optional `npx` command before running it, especially because it installs a broader external skill set.
The description includes broad everyday trigger phrases such as '到处点一点' and '随机测试', which can cause the agent to invoke this skill in loosely related contexts. Over-broad activation increases the chance of unintended tool use, context switching, or applying this skill when a more appropriate and safer skill should be selected.
The when-to-use guidance mixes explicit keywords with broad situational criteria like '需要发现脚本化测试遗漏的问题、新产品快速验证时', making activation subjective and prone to accidental triggering. In agent systems, ambiguous routing rules can cause misselection of skills, leading to inappropriate workflows or unnecessary tool access.
The skill recommends running npx skills add Kokxi/qa-test-skills without pinning an exact package version or immutable source. This creates a supply-chain risk: a future malicious or compromised release could execute attacker-controlled install-time or runtime code when users follow the instruction.
