Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent requirement-review skill with no automatic execution or persistence, though users should treat its unpinned companion install suggestion cautiously.
Install this skill if you want Chinese-oriented requirement review guidance. Be cautious with the optional companion install command: verify the source and prefer a pinned or reviewed version before running it.
The activation guidance is broad enough to trigger on many generic testing or requirement-related tasks, which can cause the agent to invoke this skill in situations the user did not explicitly request. Over-broad routing is a security and safety concern because it increases unintended prompt injection surface and may override more appropriate, narrower workflows.
The skill metadata and instructions are written to drive Chinese-language interaction without indicating that output language should follow user preference. While not a direct code-execution issue, this can degrade transparency, cause misunderstanding of safety-critical review output, and increase the chance that users accept or act on misinterpreted findings.
The skill instructs users to run npx skills add Kokxi/qa-test-skills without pinning a specific version or integrity-checked source. That creates a supply-chain risk: future package updates or account compromise could cause different code to be fetched and executed than what was originally reviewed.
The file title and instructions are entirely in Chinese and direct reviewers to follow the standard as written, but do not indicate that Chinese is optional or required for a justified region-specific purpose. This can constitute a language-policy violation because it implicitly fixes the skill's operating language without user opt-in.
