Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only QA checklist skill with narrow read-only tool access and no evidence of hidden execution, data export, persistence, or destructive behavior.
Install this skill if you want Chinese QA checklist guidance. Treat the optional npx installation line as a separate action: review the referenced package before running it, especially because it is not version-pinned.
The description and when-to-use fields include generic triggers such as '这个功能怎么测', '有什么测试要点', 'checklist', and '测试模板', which are broad phrases likely to appear in ordinary conversation about testing. The file does not provide clear exclusion conditions or negative examples to distinguish when this skill should activate versus when a different testing skill should be used.
The manifest text presents the skill behavior entirely in Chinese and frames invocation examples and usage conditions only in Chinese, which implies a language constraint without user opt-in. There is no statement that the skill can respond in the user's preferred language or that Chinese is a justified locale requirement.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Lines L021-L023 describe operational behavior such as writing files to workspace and not persisting or exporting data. However, the manifest at L006 allows only Read, Grep, and Glob, and this file provides documentation/checklists rather than executable logic that performs such writes. This is an active mismatch between documentation and the actual declared/observable behavior of the skill artifact.
The file title and introductory text are entirely in Chinese and provide no indication that language selection is optional or that the skill is intended only for a Chinese-language context. Under the policy, fixed language behavior without user opt-in or clear regional justification is a natural-language policy concern.
