Security audit
Security checks for vulnerabilities and agentic risk
This QA technical-debt skill is coherent and mostly advisory, with only minor review notes around broad activation language and an optional unpinned install command.
Review whether the Chinese-language workflow and broad trigger terms fit your team. If using the optional full skill-set install command, verify the source and prefer a pinned or reviewed version before running it.
The trigger conditions are broad enough to match common QA and project-management conversations such as '重构', '维护成本', or general technical debt discussions. Over-broad activation can cause the wrong skill to engage, pulling in extra context, files, or recommendations that are not appropriate for the user's actual task, increasing the chance of unintended actions or confusing guidance.
The manifest-facing description and usage guidance are written as Chinese-only operational instructions, and there is no statement that the skill adapts to the user's preferred language. Under the policy, a skill should not implicitly force a specific language or locale unless it offers opt-in or clearly documents a justified regional constraint.
The skill recommends running npx skills add Kokxi/qa-test-skills without pinning an exact package version or immutable source reference. This creates a supply-chain risk: a later package update, account compromise, or dependency swap could cause users to execute unintended code when installing the skill set.
This markdown file uses Chinese-only instructions and descriptions from the title through the introductory note. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.
