Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent QA testing skill with clear safety warnings, though users should be careful with its optional unpinned companion-skill install command.
Install/use this skill for authorized non-production QA environments only. Before acting on cleanup, restart, configuration, or data-modification advice, confirm the exact target environment, backup status, approval, and rollback path. Do not run the optional npx companion-skill install unless you trust the source and preferably can pin or verify the package/version.
The activation criteria are broad enough to trigger on generic requests about environments, deployment, or data preparation, increasing the chance the skill is invoked in the wrong context. Because this skill includes cleanup, configuration changes, and data-handling guidance, over-activation can lead to unsafe recommendations being surfaced for sensitive or insufficiently scoped situations.
The skill instructs users to run npx skills add Kokxi/qa-test-skills without pinning an exact package version or immutable source. This creates a supply-chain risk: a later malicious or compromised package release could be fetched and executed implicitly, which is especially concerning because npx may download and run code in the local environment.
The document title and all instructional content are written in Chinese, with no indication that other languages are supported or that Chinese is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
No suspicious patterns detected.
