Security audit
Security checks for vulnerabilities and agentic risk
This skill is a QA team coaching guide with low-risk read-only instructions, though users should verify the optional external install command before running it.
Install this as a QA coaching/reference skill, not as an authority to change team processes automatically. Treat the optional `npx skills add Kokxi/qa-test-skills` command as a separate trust decision: verify the package/source and prefer a pinned commit or version before running it.
The activation criteria are very broad, including common words such as '培训', '新人', '怎么教', and generic team-growth situations. This can cause the skill to trigger in unrelated conversations, increasing the chance that its instructions or linked content are injected into contexts where they were not intended, which expands attack surface and may bias agent behavior unexpectedly.
The skill instructs users to install a package via npx skills add Kokxi/qa-test-skills without pinning an exact version or integrity, which creates a supply-chain risk. If the upstream package, tag, or resolution path changes or is compromised, users could execute unintended code during installation.
No suspicious patterns detected.
