Security audit
Security checks for vulnerabilities and agentic risk
This is a QA testing guidance skill with disclosed, purpose-aligned content and no hidden execution, persistence, or data exfiltration behavior.
Install this only if you want Chinese-language QA testing guidance. Do not run the optional `npx skills add Kokxi/qa-test-skills` command unless you trust the source, and only use the security-testing guidance on systems where you have explicit authorization.
The skill metadata and instructions are written as Chinese-directed usage guidance and do not indicate that the user may choose another language. This can violate language/locale policy when a skill implicitly enforces a specific language without opt-in or documented justification.
The when-to-use field includes broad phrases such as “需要进行专项测试” and “功能测试完成后需要补充专项测试时”, which are general situations rather than narrowly defined trigger phrases. Without clearer constraints or negative examples, the skill could be invoked for many ordinary testing discussions beyond the intended specialized-testing scope.
The skill instructs users to run npx skills add Kokxi/qa-test-skills without pinning an exact package version or immutable source. That creates a supply-chain risk: a later compromised or malicious package release could be fetched and executed unexpectedly in the user's environment.
SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all guidance only in Chinese, with no indication that users can opt into that language or that the skill is explicitly region- or locale-specific.
