Security audit
Security checks for vulnerabilities and agentic risk
This is a read-only QA testability advice skill, with a visible but optional unpinned install command that users should treat cautiously.
Install/use this skill as advisory documentation for testability reviews. Before following the optional `npx` command, verify the publisher and source because it installs a broader, unpinned skill set. Treat any cleanup recommendations as planning advice and confirm they affect only non-critical test data before acting.
The top-level description lists broad trigger phrases such as '可测试性', '难测', and '架构改进', which can cause the skill to activate in loosely related contexts. Over-broad invocation increases the chance that the agent follows this skill when it is not the best fit, leading to unsafe or irrelevant recommendations, including its cleanup guidance about deprecated test artifacts or non-critical data.
The skill content and invocation guidance are written as if interaction will occur in Chinese, while also embedding a brief English sentence, but there is no statement that language should follow user preference. This can constitute a locale/language policy issue when the skill implicitly enforces one language without opt-in.
The when-to-use field is similarly broad and lacks guardrails or exclusion criteria, making unintended invocation likely. In a skill that gives operational improvement advice and mentions cleanup of deprecated testing assets, ambiguous routing can produce inappropriate actions or recommendations in the wrong user context.
The skill includes an installation command using npx skills add Kokxi/qa-test-skills without pinning an exact package version or immutable source. This creates a supply-chain risk: future package changes, account compromise, or typosquatting could cause users to fetch and execute unintended code or tooling during installation.
