Security audit
Security checks for vulnerabilities and agentic risk
This is a guidance-only registration helper for PowPow Bubble, with no scripts or local authority, and its sensitive topics are disclosed as user-managed web actions.
This skill is appropriate to install if you want an assistant to explain PowPow/Bubble registration and subscription steps. Users should still complete signup and payment only on the official PowPow pages and should not share passwords, verification codes, or payment proof in chat.
The markdown states that successful registration stores two HttpOnly cookies, including a JWT and a pendingUserToken, which affects authentication state and user session handling. This is a behavior with privacy and system-integrity implications, but the document presents it as implementation detail without any caution or user-facing warning.
This manifest declares "language": "id" on L14, but the notes field on L20 contains Chinese text and an alternate Chinese display name. That creates a natural-language locale inconsistency in user-facing metadata without any indication that multilingual presentation is optional or intentionally region-scoped.
This section presents original error text in Mandarin as the expected user-facing strings, and earlier lines also include a Mandarin-only login message for third-party accounts. There is no indication that the skill supports user language choice or that the Mandarin locale is intentionally limited to a region-specific deployment.
No suspicious patterns detected.
