Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed PowPow account-registration and optional payment assistant; it handles credentials and checkout flow, but the behavior is coherent with its stated purpose.
Install only if you trust PowPow and are comfortable letting the agent help create an account using your email, verification code, optional avatar, and password passed via environment variable. For payment, the agent should only create/open the checkout and poll status; you should complete payment yourself and verify the browser is on an official Alipay or PayPal page. Run cleanup at the end to remove the temporary token state.
Referenced artifact was not completely inspected
- मुख्य स्क्रिप्ट `scripts/powpow-register.mjs`: **ज़ीरो डिपेंडेंसी**, **Node ≥ 18** चाहिए। शुरू करने से पहले एक बार `node scripts/powpow-register.mjs status` च
Referenced artifact was not completely inspected
- मुख्य स्क्रिप्ट `scripts/powpow-register.mjs`: **ज़ीरो डिपेंडेंसी**, **Node ≥ 18** चाहिए। शुरू करने से पहले एक बार `node scripts/powpow-register.mjs status` च
Referenced artifact was not completely inspected
- मुख्य स्क्रिप्ट `scripts/powpow-register.mjs`: **ज़ीरो डिपेंडेंसी**, **Node ≥ 18** चाहिए। शुरू करने से पहले एक बार `node scripts/powpow-register.mjs status` च
Referenced artifact was not completely inspected
- मुख्य स्क्रिप्ट `scripts/powpow-register.mjs`: **ज़ीरो डिपेंडेंसी**, **Node ≥ 18** चाहिए। शुरू करने से पहले एक बार `node scripts/powpow-register.mjs status` च
Referenced artifact was not completely inspected
- मुख्य स्क्रिप्ट `scripts/powpow-register.mjs`: **ज़ीरो डिपेंडेंसी**, **Node ≥ 18** चाहिए। शुरू करने से पहले एक बार `node scripts/powpow-register.mjs status` च
Referenced artifact was not completely inspected
- मुख्य स्क्रिप्ट `scripts/powpow-register.mjs`: **ज़ीरो डिपेंडेंसी**, **Node ≥ 18** चाहिए। शुरू करने से पहले एक बार `node scripts/powpow-register.mjs status` च
Referenced artifact was not completely inspected
- मुख्य स्क्रिप्ट `scripts/powpow-register.mjs`: **ज़ीरो डिपेंडेंसी**, **Node ≥ 18** चाहिए। शुरू करने से पहले एक बार `node scripts/powpow-register.mjs status` च
Referenced artifact was not completely inspected
- मुख्य स्क्रिप्ट `scripts/powpow-register.mjs`: **ज़ीरो डिपेंडेंसी**, **Node ≥ 18** चाहिए। शुरू करने से पहले एक बार `node scripts/powpow-register.mjs status` च
Referenced artifact was not completely inspected
- मुख्य स्क्रिप्ट `scripts/powpow-register.mjs`: **ज़ीरो डिपेंडेंसी**, **Node ≥ 18** चाहिए। शुरू करने से पहले एक बार `node scripts/powpow-register.mjs status` च
Referenced artifact was not completely inspected
- मुख्य स्क्रिप्ट `scripts/powpow-register.mjs`: **ज़ीरो डिपेंडेंसी**, **Node ≥ 18** चाहिए। शुरू करने से पहले एक बार `node scripts/powpow-register.mjs status` च
Referenced artifact was not completely inspected
- मुख्य स्क्रिप्ट `scripts/powpow-register.mjs`: **ज़ीरो डिपेंडेंसी**, **Node ≥ 18** चाहिए। शुरू करने से पहले एक बार `node scripts/powpow-register.mjs status` च
The skill description and operating guidance are presented entirely in Hindi, and the file does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
The manifest description and all user-facing instructions in SKILL.md are presented in Hindi, including trigger phrases, workflow steps, and UX guidance. This imposes a specific language on users without documenting an opt-in, alternative language, or region-specific justification.
The skill explicitly instructs the agent to invoke OS shell commands (start, open, xdg-open) on a file path returned by a script. That expands the agent's authority from web registration assistance into local command execution, and if the returned path or invocation is not strictly validated, it creates a command-invocation surface that could open arbitrary files, handlers, or be abused through path/argument injection.
The manifest explicitly sets the skill language to "hi", while other metadata includes Chinese text and an English domain, suggesting a broader audience rather than a clearly region-specific tool. There is no indication of user opt-in, alternate locale support, or justification for restricting the skill to Hindi.
Lines L127-L129 instruct the agent to keep the same tone and always end with a specific Hindi phrase («अगला कदम»), which imposes a language/locale behavior in natural-language guidance. The file does not provide any user opt-in or explain that the skill is intentionally region- or language-specific.
The document instructs the agent to take server-returned paymentHtml, write it to a local HTML file, and open it via system commands. That creates a local content execution path from remotely supplied HTML without explicit safety constraints, sandboxing, origin validation, or user warning; if the HTML is malicious or compromised upstream, it could trigger unsafe browser behavior, deceptive payment flows, or local-file context abuse.
This file hardcodes a specific language/locale presentation for the skill guidance and references fixed Chinese UI text throughout, but does not state that the skill is region-specific or provide user opt-in for language preference. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
SQP-3 applies to all file types and includes language or locale policy violations. This markdown instruction file forces a specific language for all operational guidance, and there is no indication that users may choose another language or that the restriction is required for a region-specific purpose.
SQP-3 covers language or locale policy violations across all file types. The document is written entirely in Hindi while also embedding some English and Chinese UI text, but it does not state that the language is optional or user-selectable, which may conflict with a policy requiring user language choice.
Lines L48-L50 state that the script uses the same public APIs and that all rules in this file apply identically in both modes. But L61-L63 clarifies that a key registration outcome step (subscription redirect) may not trigger during the free trial, changing the effective behavior after registration. This is a documentation-level contradiction about whether the described flow is uniformly applied.
The documentation claims the state file only stores email, username, nickname, JWT token, order number, and flow step. In practice, later code saves extra fields such as userId, codeSentAt, provider, amount, subscriptionId, approveUrl, planName, planPrice, and timestamps, which contradicts the stated storage scope rather than merely omitting an implementation detail.