Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-style QA retrospective skill with low runtime authority, though users should review the optional unpinned skill-set install command before running it.
Safe to install as a retrospective guide. Before running the optional command to add the larger skill set, review that package source and prefer a pinned trusted version because it may install additional skills beyond this artifact.
The manifest description and when-to-use guidance are primarily written in Chinese and present the skill behavior in that language without stating that other languages are supported or that the user may choose their preferred language. This can violate language/locale policy when a skill implicitly constrains interaction language without opt-in.
The skill recommends running npx skills add Kokxi/qa-test-skills without pinning a specific version or commit. This creates a supply-chain risk: users may fetch and execute whatever version is current at install time, including a compromised or malicious update.
No suspicious patterns detected.
