Security audit
Security checks for vulnerabilities and agentic risk
This is a QA metrics guidance skill with no automatic execution or hidden data handling, though its optional unpinned install suggestion deserves caution.
Installers should treat this as benign QA guidance, but should not run the optional npx companion-install command unless they trust the Kokxi/qa-test-skills source and preferably pin or verify the exact version.
L04 lists broad triggers such as “质量数据”, “趋势分析”, and “向管理层展示质量数据时”, alongside a general 'use when' description. These phrases are common in normal project conversations and the file does not provide exclusion conditions or negative examples to clarify when the skill should not activate.
L10 says the skill should be used when the user mentions phrases like “趋势分析” or when they 'need to build a metrics system' or present quality data to management. This combines specific and very general conditions, but does not define what kinds of trend analysis or management reporting are in scope versus out of scope.
The manifest output-format explicitly says coverage conclusions must label scope and prohibits absolute expressions like '全覆盖/100%'. However, the report template later presents '需求覆盖率：[X]% (目标100%)', which directly encourages the kind of absolute coverage target the documentation says to avoid.
The skill instructs users to install an external package via npx skills add Kokxi/qa-test-skills without pinning a version or commit. That creates a supply-chain risk: a future package update or compromise could change what gets fetched and executed, and npx commonly runs retrieved code during installation. In this context the risk is real, though it appears operationally convenient rather than malicious.
L04 presents the primary description in Chinese with an English sentence appended, but nowhere indicates that the user may choose their preferred language. This can violate a language/locale choice policy when a skill appears to assume a default language rather than explicitly honoring user preference.
This markdown file presents user-facing instructional content entirely in Chinese and does not indicate that the language choice is optional or region-specific. Under the policy rule for language or locale constraints, forcing a single language without user opt-in can be a natural-language policy violation.
