Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent QA regression-testing guidance skill with limited read-only tools and no evidence of hidden execution, persistence, or data exfiltration.
Installers should review the broader Kokxi/qa-test-skills package before running the unpinned npx command, especially because it may add more skills than this artifact. The reviewed skill itself is read-only guidance for regression planning and does not show hidden execution or persistence.
The skill instructs users to run npx skills add Kokxi/qa-test-skills without pinning an exact package version or immutable source reference. This creates a supply-chain risk: a later package update, account compromise, or malicious republish could cause users to install unexpected code when following the documentation.
The natural-language description and when-to-use field specify user utterances entirely in Chinese, which can act as a locale-specific policy constraint. The file also includes some English text, but it does not explicitly state that other languages are supported or that Chinese is required for a region-specific purpose.
The file title and introductory instructions are entirely in Chinese and provide no indication that another language can be used. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
No suspicious patterns detected.
