Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent QA test-case design template with no hidden execution, persistence, credential access, or destructive behavior found.
Install if you want Chinese-language QA test-case formatting guidance. Before running the optional `npx skills add Kokxi/qa-test-skills` command, verify the package/source and prefer a pinned trusted version if available.
The primary natural-language instructions and trigger conditions are written in Chinese and present the skill behavior as Chinese-first, while the file does not state that users may choose another language. Under the policy, forcing a specific language without opt-in is a language/locale policy concern.
The trigger list includes generic phrases such as '用例评审', '用例覆盖', and '需要编写或规范测试用例时', which can arise in many ordinary QA conversations and do not clearly distinguish when this specific skill should activate. The description does not provide exclusion conditions or negative examples to clarify when the skill should not be invoked.
The manifest-style 'when-to-use' text lists broad user utterances and a catch-all condition '需要测试用例结构指导、需要编写或规范测试用例时', which lacks concrete scope limits. This makes it unclear when the skill should activate versus when related upstream or downstream QA skills should be used instead.
The skill recommends installing a package via npx skills add Kokxi/qa-test-skills without pinning a specific version or immutable source. That creates a supply-chain risk: users may fetch whatever package version is current at execution time, including a compromised or malicious update.
This markdown file contains user-facing instructions exclusively in Chinese, including the title, examples, and operational guidance. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
The file title and all guidance are written exclusively in Chinese, which constitutes a language-specific constraint in natural-language content. There is no indication that the skill is region-specific or that users may opt into this locale, so it may violate language/locale policy requirements.
The title begins with Chinese and the document consistently presents the format as the single authoritative standard, with no indication that other languages are allowed. This can violate language/locale policy because it effectively forces a specific language without user opt-in or a documented regional justification.
This markdown file contains user-facing natural-language guidance only in Chinese, and nowhere indicates that the skill supports multiple languages or that Chinese is a required locale. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in is a policy concern.
No suspicious patterns detected.
