Security audit
Security checks for vulnerabilities and agentic risk
This skill provides disclosed guidance for bulk test-data creation and masking, with no hidden execution or persistence behavior found.
Safe to install for test-data engineering guidance. Before following the optional npx command to add the broader skill set, verify the publisher/repository and prefer a pinned or reviewed version; also keep the provided SQL/API examples limited to isolated test environments.
The description lists broad phrases such as “造数”, “数据构造”, and “环境数据不足需要批量构造时” as activation cues without clear boundaries or exclusions. These terms can overlap with common testing and engineering discussion, making it unclear when this skill should activate versus when a different skill should handle the request.
The skill metadata and body are predominantly written in Chinese and present usage guidance in that language, while also embedding a single English sentence, suggesting no explicit user choice of language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is documented and justified.
The manifest field activates on short phrases like “造数”, “批量造数”, and “需要管理测试数据”, which are broad and could match many ordinary QA conversations. Because it does not define exclusions or a narrow context, the invocation boundary is underspecified.
The skill recommends installing and executing an external package via npx skills without pinning a specific version or integrity. That creates a supply-chain risk: a malicious or compromised latest package version could execute arbitrary code on the user's machine at install/runtime.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 示例：通过API构造订单数据
def create_test_order(user_id, product_id, quantity=1):
response = requests.post(
f"{BASE_URL}/orders",
json={
"user_id": user_id,
No suspicious patterns detected.