Security audit
Security checks for vulnerabilities and agentic risk
This is a read-only QA risk-assessment skill with no hidden execution behavior, though users should treat its optional unpinned install command cautiously.
Install this as a read-only QA helper if you want Chinese-language risk prioritization guidance. Avoid running the optional `npx skills add Kokxi/qa-test-skills` command unless you trust that source and have reviewed the companion package or pinned it to a known version.
The trigger list includes generic phrases such as “风险评估”, “优先级”, and “测试重点”, which are common in many testing conversations and not unique to this skill. The file does not provide clear exclusion conditions or negative examples to distinguish when this skill should activate versus related QA skills.
The when-to-use metadata uses broad phrases like “优先级” and “需要判断测试重点”, which can match ordinary QA requests beyond this skill’s intended purpose. Because no constraints or counterexamples are given, an agent could invoke the skill too often or in the wrong context.
The skill recommends installing a package via npx skills add Kokxi/qa-test-skills without pinning a specific version or commit. That creates a supply-chain risk: a later malicious or compromised release could be fetched at execution time and run in the user's environment.
The entire template and instructions are written exclusively in Chinese, including headings, field requirements, and examples, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified.
This markdown file contains all user-facing guidance in Chinese, and there is no indication that the skill offers multilingual support, user opt-in, or that it is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
