Security audit
Security checks for vulnerabilities and agentic risk
The skill appears purpose-built for PowPow registration, but it handles passwords, live login tokens, and payment-page opening in ways users should review carefully before installing.
Install only if you are comfortable letting the skill assist with account creation and payment setup for PowPow. Treat generated login links as sensitive because they can log into the account, confirm before any payment page is opened, and run cleanup when finished or if the flow is interrupted.
Referenced artifact was not completely inspected
- Core script `scripts/powpow-register.mjs`: **zero dependencies**, requires **Node ≥ 18**. Run `node scripts/powpow-register.mjs status` once before starting t
Referenced artifact was not completely inspected
- Core script `scripts/powpow-register.mjs`: **zero dependencies**, requires **Node ≥ 18**. Run `node scripts/powpow-register.mjs status` once before starting t
Referenced artifact was not completely inspected
- Core script `scripts/powpow-register.mjs`: **zero dependencies**, requires **Node ≥ 18**. Run `node scripts/powpow-register.mjs status` once before starting t
Referenced artifact was not completely inspected
- Core script `scripts/powpow-register.mjs`: **zero dependencies**, requires **Node ≥ 18**. Run `node scripts/powpow-register.mjs status` once before starting t
Referenced artifact was not completely inspected
- Core script `scripts/powpow-register.mjs`: **zero dependencies**, requires **Node ≥ 18**. Run `node scripts/powpow-register.mjs status` once before starting t
Referenced artifact was not completely inspected
- Core script `scripts/powpow-register.mjs`: **zero dependencies**, requires **Node ≥ 18**. Run `node scripts/powpow-register.mjs status` once before starting t
Referenced artifact was not completely inspected
- Core script `scripts/powpow-register.mjs`: **zero dependencies**, requires **Node ≥ 18**. Run `node scripts/powpow-register.mjs status` once before starting t
Referenced artifact was not completely inspected
- Core script `scripts/powpow-register.mjs`: **zero dependencies**, requires **Node ≥ 18**. Run `node scripts/powpow-register.mjs status` once before starting t
Referenced artifact was not completely inspected
- Core script `scripts/powpow-register.mjs`: **zero dependencies**, requires **Node ≥ 18**. Run `node scripts/powpow-register.mjs status` once before starting t
Referenced artifact was not completely inspected
- Core script `scripts/powpow-register.mjs`: **zero dependencies**, requires **Node ≥ 18**. Run `node scripts/powpow-register.mjs status` once before starting t
Referenced artifact was not completely inspected
- Core script `scripts/powpow-register.mjs`: **zero dependencies**, requires **Node ≥ 18**. Run `node scripts/powpow-register.mjs status` once before starting t
The skill describes capabilities that use environment variables and make network requests, but it does not declare an explicit tool/permission scope. That weakens least-privilege enforcement and makes it harder for the host to constrain what the skill may access, especially because it handles credentials, email verification, and login/payment flows. In this context, undeclared capabilities increase risk rather than being a harmless omission.
The skill instructs the agent to execute OS-level commands (start, open, xdg-open) on a locally generated file path. Even if intended to launch a payment page, crossing from web automation into arbitrary local command execution is dangerous because a compromised or malformed path, script output, or surrounding shell invocation could trigger unintended local actions. The registration/payment context makes this more sensitive because it combines credentialed flows with local execution.
The skill directs the agent to open a locally generated payment page automatically, but it does not require a clear user-facing warning or confirmation at that point. That creates a surprise side effect during a sensitive payment flow and reduces the user's ability to verify what is being opened before local/browser actions occur. In a payment-related skill, silent or implicit launching is especially risky and can facilitate phishing-like or unsafe navigation behavior.
The manifest sets the skill language to "en" with no indication that users may choose another language or that the skill is region- or language-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The instructions direct the agent to write provider-supplied payment HTML to a local file and open it with a system command, which can launch an external payment or authorization flow without an explicit user-facing consent step or warning about disclosure to Alipay/PayPal. In a skill that operates entirely inside the conversation and handles registration/payment orchestration, that omission increases the risk of surprise navigation, phishing confusion, or users unknowingly transmitting account-linked data to third-party payment providers.
This markdown file says to use screenshots "as needed at runtime" and when the user "has no idea what Bubble is," which are subjective conditions that overlap with common conversation and do not clearly bound when the skill should activate. The file also lacks explicit exclusion conditions or negative examples to prevent unintended invocation.
The script generates a one-click login URL that embeds a live session token in the query string. Query parameters are commonly exposed via shell history, chat transcripts, browser history, logs, Referer headers, and screenshots, so anyone who obtains the URL can reuse the token to impersonate the user until it expires. In this skill’s context, the agent is explicitly designed to pass such links back to users inside a conversation, which increases the chance of token disclosure through conversational storage and auditing systems.
The flow explicitly instructs the operator to open generated payment/authorization pages and poll remote payment status, but it does not clearly warn the user that registration data, authentication state, and payment-related metadata will be transmitted to the remote PowPow platform and third-party payment providers. In a conversation-driven agent flow, missing disclosure can mislead users about where their data is going and when they are leaving the assistant-controlled context, increasing consent and privacy risk.
SQP-3 applies to all file types and covers language or locale policy violations. The wording assigns Alipay to mainland-China users and PayPal to overseas users, which can be read as enforcing a locale-based policy rather than offering a neutral user choice, and no explicit opt-in or policy justification is provided.
This markdown file contains a login error message in Chinese as the presented default text, and similar Chinese-only strings recur throughout the troubleshooting table. Because the file does not offer a language/locale option or explain that the skill is intentionally China-region-specific, it may violate the language/locale policy requirement.
The error lookup table uses multiple Chinese messages as canonical user-facing outputs, while the document does not state that the skill is limited to a Chinese-language audience or region. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
The generated HTML hard-codes lang="en" and English page text regardless of user preference. This is a natural-language locale policy issue because the script otherwise uses Chinese user-facing messaging and does not offer opt-in or explain why English is required here.