Security audit
Security checks for vulnerabilities and agentic risk
This is a read-only Chinese QA reporting skill with coherent templates and no artifact-backed evidence of hidden execution, data exfiltration, persistence, or destructive behavior.
Installers should treat this as a Chinese-language QA reporting helper. Review generated release or delay recommendations as report content only, not as authorization to make business decisions. Do not run the optional `npx skills add Kokxi/qa-test-skills` command unless you trust and verify that external package/source.
The listed trigger scenarios include generic phrases like '日报', '周报', '报告模板', and '进度汇报', which are common everyday work terms and could match many unrelated requests. The description does not provide exclusion conditions or negative examples to clarify when this skill should not activate.
The when-to-use field includes broad phrases like '需要编写测试报告' and '向管理层汇报测试进展时' without defining required inputs, scope limits, or cases where another reporting or communication skill should be used instead. This ambiguity increases the chance of unintended invocation across general reporting tasks.
The skill recommends installing a package via npx skills add Kokxi/qa-test-skills without pinning a specific version or immutable source. This creates a supply-chain risk: a future malicious or compromised upstream release could be fetched and executed at install time, and the surrounding text encouraging installation increases the likelihood of unsafe operator action.
This markdown file contains user-facing reporting templates and instructions exclusively in Chinese, and it does not indicate that the skill is intended only for a Chinese-speaking audience or provide an opt-in language choice. Under the natural-language policy rule, forcing a specific language without user choice can be a locale-policy violation.
No suspicious patterns detected.
