Security audit
Security checks for vulnerabilities and agentic risk
This is a German-language guidance skill for registering and activating a PowPow/Bubble account, with no scripts, local execution, credential collection, or hidden persistence.
Install only if you want German-language guidance for PowPow/Bubble registration. The assistant should never ask for your password, email verification code, payment proof, or card details; complete registration and any recurring subscription only on the official PowPow, PayPal, WeChat, or Huawei flows.
The skill description is written as a German-only assistant description ('Der Bubble-Registrierungsassistent') and does not mention any user language choice or that the skill is intentionally limited to German speakers. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The conversation UX section mandates a specific service tone and provides all required user-facing phrasing in German, with no indication that the assistant should adapt to the user's preferred language. This is a natural-language locale policy concern because the skill effectively constrains output language without opt-in or an explicit, justified regional limitation.
The manifest sets the skill language to "de" and the display text is written in German, but there is no indication that users can opt into this locale or that the skill is intentionally restricted to a German-speaking region. This is a natural-language policy concern because it enforces a specific language without offering a choice or documenting a justified locale constraint.
The instruction 'Zur Laufzeit nach Bedarf verwenden' combined with broad triggers like 'wenn der Nutzer ... das fertige Produkt sehen muss' creates loose activation criteria for sending external screenshots. In an agent setting, ambiguous scope can cause the skill to be invoked outside clearly relevant contexts, increasing the chance of unnecessary outbound links, privacy-unaware sharing, or off-topic steering of the conversation.
The skill documentation is primarily in German, but it specifies fixed English user-facing text such as "Auto-renews. Cancel anytime." and "You're All Set!". Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation when no locale choice or justification is provided.
Line L24 specifies that the phone number must be a mainland China number with a particular pattern. This is a locale restriction presented as a rule, but the document does not explicitly justify it as a region-specific limitation or provide user choice, which may conflict with language/locale policy expectations.
All guidance in the file is written in German and instructs the agent how to respond, but there is no indication that the skill is limited to German-language use cases or that users can opt into another language. This can violate language/locale policy when a skill effectively forces one language without user choice.
No suspicious patterns detected.
