Security audit
Security checks for vulnerabilities and agentic risk
This skill is a guidance-only Amharic helper for PowPow registration and account activation, with no scripts or authority to handle credentials or payments.
Install this only if you want Amharic guidance for registering and activating a PowPow/Bubble account. Follow the payment and sign-up steps yourself in the official site or app, and do not share passwords, verification codes, or payment credentials with the assistant. Expect the skill to show external PowPow, GitHub-hosted screenshot, and Bilibili links when explaining the product.
The storefront metadata advertises broader product capabilities than the manifested behavior, which is limited to sign-up and activation guidance. Such overclaiming is dangerous because users may rely on the skill for unsupported actions, increasing the chance of confusion, consent issues, and collection of information under false expectations.
The listing markets map-social and digital-human features even though the skill is described as registration-only guidance and the notes explicitly say those capabilities belong to another skill. This creates a deceptive scope mismatch that can mislead users into invoking the skill for functions it does not provide, weakening user trust and potentially steering users into inappropriate data-sharing or unsafe follow-on flows.
The skill description is written entirely in Amharic, which effectively imposes a language requirement on users reading the README. The file does not indicate that other languages are supported or that this locale restriction is intentional for a region-specific audience.
The manifest explicitly sets the language to "am", which indicates a fixed locale. There is no accompanying justification that this is a region-specific skill, nor any indication that users can opt into another language, which conflicts with the policy against forcing a specific language without user opt-in.
This markdown file is primarily written in Amharic, but line L25 presents a user-facing error string in Chinese as the expected message. Because the skill does not state that Chinese-language responses are intentional or region-specific, this appears to force a specific language without user opt-in, which matches the locale-policy violation criteria.
Lines L52-L64 list numerous expected system messages in Chinese while the rest of the document is in Amharic. This creates a natural-language policy concern because the skill documentation appears to require or expect a fixed language for user-visible output, with no opt-in or explanation that the system is intentionally region-specific.
The document is entirely written in Amharic and does not offer any language or locale choice, opt-in, or justification for restricting operation to that language. Under the policy rule for natural-language constraints, this can be a language/locale policy issue unless the skill is explicitly documented as region- or audience-specific.
The instruction says to use the screenshots 'as needed' and send a link directly if the user lacks Bubble context or wants to 'see' the product, but it does not clearly bound when the skill should or should not activate. This is a vague trigger description in a markdown file and could overlap with many ordinary product-explanation conversations without explicit exclusions or negative examples.
The manifest says this is a guidance-only skill limited to PowPow account registration, troubleshooting during sign-up, and subscription activation, and explicitly says posting content and creating digital humans are out of scope. This file instead instructs the agent to send screenshots and explain unrelated product capabilities such as digital humans, post editing, maps, badges, game progression, and post details, which expands the behavior beyond the described registration/activation purpose.
No suspicious patterns detected.
