Security audit
Security checks for vulnerabilities and agentic risk
This is a read-only QA guidance skill for designing state-transition tests, with one optional unpinned install suggestion users should treat cautiously.
Install only if you want Chinese-language state-transition testing guidance. Do not run the optional `npx skills add Kokxi/qa-test-skills` command unless you trust and have reviewed that external package source.
The activation criteria are very broad (状态测试, 状态机, 状态变更, etc.) and overlap with common QA terminology, increasing the chance the skill will be invoked in contexts the user did not intend. Unintended invocation can steer agent behavior, consume context, or override more appropriate skills, which is a prompt-scope and control-flow weakness rather than direct code execution.
Nearly all user-facing instructions, examples, metadata, and outputs are written exclusively in Chinese, and the trigger conditions in metadata are also Chinese-only. There is no statement offering language selection or explaining that the skill is intentionally limited to a Chinese-language environment.
The skill instructs users to run npx skills add Kokxi/qa-test-skills without pinning an exact package version or immutable source. This creates a supply-chain risk: a later package update, account compromise, or dependency change could cause different code to be fetched and executed than what was originally reviewed.
