Security audit
Security checks for vulnerabilities and agentic risk
This is a guide-only Bengali skill for PowPow registration and subscription activation, with no code execution or credential handling in the package.
Install only if you want a Bengali PowPow onboarding guide. The user should complete registration, verification, and payment only on the official PowPow pages or app, and should not give the assistant passwords, verification codes, or payment proof.
The skill description is written as a Bangla-only user-facing guide and the repository structure notes 'language rules' in the main guide, but this README does not indicate that users can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
The instructions require the agent to follow a fixed 'powpow' service-style phrasing and explicitly say not to provide certain security advice unless asked. This enforces a particular communication style for all interactions without offering the user a language or locale choice.
The manifest sets the skill language to "bn", while the metadata also contains mixed Bengali and Chinese text, but provides no indication that users can choose another language or that the locale restriction is required for a region-specific purpose. This is a natural-language policy concern because the skill appears to enforce a specific language setting without documented opt-in or justification.
The entire skill reference is written in Bengali, including operational guidance and user-facing instructions, with no indication that other languages are supported or that Bengali is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
The document explicitly says chat/CLI payment must not be attempted, but later discloses an Alipay payment path that can fall back to simulated payment when keys are absent. Even though it is described as inactive/reserved code, documenting a simulation-capable payment endpoint in the same skill context can encourage misuse, confusion in downstream agent behavior, or accidental reliance on non-production payment flows.
This markdown file contains user-facing operational guidance only in Bengali, with embedded Chinese messages, and does not indicate that the user can choose another language or that the skill is intentionally limited to a Bengali- or Chinese-speaking audience. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
No suspicious patterns detected.
