Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-style testing architecture skill with disclosed, purpose-aligned behavior and no evidence of hidden execution or data exfiltration.
Review the unpinned `npx skills add Kokxi/qa-test-skills` recommendation before running it, especially if you require locked versions or verified provenance. Avoid pasting real production customer, payment, identity, or screenshot data into the workflow unless it has been masked, as the skill itself warns.
The skill description and when-to-use field include generic phrases such as “框架设计”, “自动化策略”, and “需要设计测试自动化架构” that could overlap with a wide range of ordinary testing or engineering discussions. Although some examples are domain-related, the file does not clearly define boundaries or non-matching cases, which increases the chance of unintended invocation.
The skill instructs users to run npx skills add Kokxi/qa-test-skills without pinning an exact package version. This can cause users to fetch and execute whatever version is current at install time, increasing supply-chain risk if the package is updated maliciously, compromised, or changed incompatibly.
This markdown file presents its instructions and usage context only in Chinese, and there is no indication that the skill is region-specific or that users can opt into that language. Under the language/locale policy, forcing a specific language without user choice can be a natural-language policy violation.
