Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only registration guide for PowPow/Gelembung, with no code execution, credential collection, or hidden install behavior.
Before installing, confirm you want a Javanese-language PowPow registration helper and are comfortable receiving product links and screenshots hosted on public third-party services. Do not share passwords, verification codes, or payment proof with the assistant; the skill itself correctly says those actions stay in the browser or app.
The user-facing skill description and operational guidance are written in Javanese throughout, with no indication that other languages are supported or that this locale restriction is intentional. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Line L14 sets the manifest language to "jv", and the listing text also uses Javanese prominently. In this file there is no indication that users can choose another language or that the locale restriction is justified, which matches the language/locale policy violation criteria.
This file forces a specific language for operational guidance, which can violate language/locale policy when users are not given an opt-in or alternative. The content does not indicate that the skill is region-specific or that another language version is available.
The document includes a fixed Chinese error message as the expected login behavior, indicating the skill is tied to Mandarin user-facing output. There is no indication that users can choose their language or that the Chinese-only behavior is a justified region-specific requirement, which creates a language/locale policy concern.
The troubleshooting section explicitly treats Mandarin error strings as the primary reference text for multiple user flows. Because the file does not state that the skill is limited to a Chinese locale or offer any localization option, this is a natural-language locale-policy issue.
The entire skill reference is authored in a specific language/locale, and the file does not indicate that users or operators can choose another language. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern unless the locale constraint is clearly documented and justified.
This markdown file tells the agent to send raw GitHub or jsDelivr image links directly and states the images can be sent out, but it does not warn that doing so will load content from third-party hosts. For markdown files, omission of a warning about behavior that can affect user privacy is in scope for missing user warnings.
No suspicious patterns detected.
