Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly coherent for helping users register and subscribe to PowPow, but it handles passwords, login tokens, and payment flows with under-disclosed local persistence and browser-opening behavior.
Install only if you are comfortable letting the agent help create a PowPow account, handle a password or verification code, hold a temporary login token, and optionally open payment checkout pages. Run cleanup after use, avoid reusing an important password, and complete payment only in the official Alipay or PayPal browser flow.
Referenced artifact was not completely inspected
- Skrip inti `scripts/powpow-register.mjs`: **tanpa dependensi**, butuh **Node >= 18**. Sadurunge miwiti, jalanke sepisan `node scripts/powpow-register.mjs stat
Referenced artifact was not completely inspected
- Skrip inti `scripts/powpow-register.mjs`: **tanpa dependensi**, butuh **Node >= 18**. Sadurunge miwiti, jalanke sepisan `node scripts/powpow-register.mjs stat
Referenced artifact was not completely inspected
- Skrip inti `scripts/powpow-register.mjs`: **tanpa dependensi**, butuh **Node >= 18**. Sadurunge miwiti, jalanke sepisan `node scripts/powpow-register.mjs stat
Referenced artifact was not completely inspected
- Skrip inti `scripts/powpow-register.mjs`: **tanpa dependensi**, butuh **Node >= 18**. Sadurunge miwiti, jalanke sepisan `node scripts/powpow-register.mjs stat
Referenced artifact was not completely inspected
- Skrip inti `scripts/powpow-register.mjs`: **tanpa dependensi**, butuh **Node >= 18**. Sadurunge miwiti, jalanke sepisan `node scripts/powpow-register.mjs stat
Referenced artifact was not completely inspected
- Skrip inti `scripts/powpow-register.mjs`: **tanpa dependensi**, butuh **Node >= 18**. Sadurunge miwiti, jalanke sepisan `node scripts/powpow-register.mjs stat
Referenced artifact was not completely inspected
- Skrip inti `scripts/powpow-register.mjs`: **tanpa dependensi**, butuh **Node >= 18**. Sadurunge miwiti, jalanke sepisan `node scripts/powpow-register.mjs stat
Referenced artifact was not completely inspected
- Skrip inti `scripts/powpow-register.mjs`: **tanpa dependensi**, butuh **Node >= 18**. Sadurunge miwiti, jalanke sepisan `node scripts/powpow-register.mjs stat
Referenced artifact was not completely inspected
- Skrip inti `scripts/powpow-register.mjs`: **tanpa dependensi**, butuh **Node >= 18**. Sadurunge miwiti, jalanke sepisan `node scripts/powpow-register.mjs stat
Referenced artifact was not completely inspected
- Skrip inti `scripts/powpow-register.mjs`: **tanpa dependensi**, butuh **Node >= 18**. Sadurunge miwiti, jalanke sepisan `node scripts/powpow-register.mjs stat
Referenced artifact was not completely inspected
- Skrip inti `scripts/powpow-register.mjs`: **tanpa dependensi**, butuh **Node >= 18**. Sadurunge miwiti, jalanke sepisan `node scripts/powpow-register.mjs stat
The skill directs the agent to collect and use highly sensitive credentials: user-chosen passwords, email verification codes, and login-link generation that can authenticate the session. Even though it includes some operational precautions (for example, using an environment variable instead of CLI args), it normalizes secret handling inside the chat workflow without requiring explicit informed consent, minimization, or a safer user-entered flow. In practice, this creates account-takeover risk if the agent, logs, integrations, or surrounding platform expose the password or verification code.
The skill instructs the agent to initiate subscription purchase flows, create orders, open local payment pages, and poll payment state, all within the conversational workflow. Although it says not to touch the user's Alipay/PayPal account directly, it still enables the agent to drive financial actions without a strong upfront confirmation and safety boundary, increasing the risk of unauthorized or confusing charges, phishing-like UX, or mistaken purchases. The danger is amplified because the agent is told to open checkout pages on the user's behalf and continue monitoring payment completion.
This JSON manifest provides display and search keywords but does not define when the skill should or should not activate, nor does it include exclusion conditions or negative examples. Terms like the listed keywords are descriptive but the overall trigger scope remains underspecified for a manifest file, which can lead to unintended matching or invocation.
The language field is set to jv, and there is no accompanying text offering alternative languages or documenting that the locale restriction is intentional and justified. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
The entire skill guidance is written in Javanese/Indonesian-localized language and instructs the agent to maintain that same voice, but nowhere offers the user a language preference or opt-in. This can violate organizational language/locale policy when users are not explicitly given a choice of language.
This file presents operational instructions in a specific language/locale mix without indicating that the user can choose their preferred language or that the skill is intentionally region-specific. Under the policy, forcing a language or locale without opt-in can be a natural-language policy violation unless the constraint is documented and justified.
The skill explicitly instructs the agent to write server-returned payment HTML to a local temporary file and open it with a system command, but it does not require an explicit user-facing warning or confirmation before performing those local side effects. Because the HTML is remotely supplied payment content, automatically launching it can expose users to unexpected browser execution, local file handling, and trust-boundary confusion around what the agent is doing on the host.
The PayPal flow similarly directs the agent to write approval content to a local HTML file and open it, without clearly warning the user that the skill will create files and launch a browser on their machine. Even though the purpose is payment approval, silent local file creation and browser execution reduce user awareness and can be abused if the returned content or launch mechanism is ever manipulated.
The entire skill reference is written in Javanese, while embedded user-facing examples and platform strings are in Chinese, and the document does not offer an alternative language or state that the skill is region-specific. This creates a natural-language policy concern because it imposes a locale on operators without opt-in or documented justification.
The script’s documented data-minimization claim is inaccurate: beyond email, username, nickname, token, order number, and step, it also persists fields such as userId, provider, package, amount, subscriptionId, approveUrl, timestamps, and plan details in a predictable temp-file location. This increases exposure of account/payment metadata to other local processes or users who can access the temp area, and can mislead operators into underestimating what sensitive data is retained.
The Conversation UX section requires the agent to follow a specific 'PowPow' service voice and includes fixed response-structure requirements. In a file otherwise written for a specific locale, this can amount to forcing a particular language/interaction style without explicit user opt-in or choice.
The generated HTML hard-codes lang="en" and English-only page text/title for the PayPal redirect page. This is a natural-language locale choice imposed by the skill without any user opt-in or documented justification, which matches the language/locale policy concern.