Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent PowPow registration and payment helper, but it handles account credentials, session tokens, payment setup, local temp files, and browser-launch commands in ways users should review carefully before installing.
Install only if you intend to let the skill help create and access a PowPow account. Before running payment steps, confirm the plan and provider yourself, expect a temporary local checkout file and browser launch, and run cleanup when finished so the local session-token state file is removed.
Referenced artifact was not completely inspected
- Script monene `scripts/powpow-register.mjs`: **ezali na dependance te**, esengi **Node >= 18**. Liboso ya kobanda sala mbala moko `node scripts/powpow-registe
Referenced artifact was not completely inspected
- Script monene `scripts/powpow-register.mjs`: **ezali na dependance te**, esengi **Node >= 18**. Liboso ya kobanda sala mbala moko `node scripts/powpow-registe
Referenced artifact was not completely inspected
- Script monene `scripts/powpow-register.mjs`: **ezali na dependance te**, esengi **Node >= 18**. Liboso ya kobanda sala mbala moko `node scripts/powpow-registe
Referenced artifact was not completely inspected
- Script monene `scripts/powpow-register.mjs`: **ezali na dependance te**, esengi **Node >= 18**. Liboso ya kobanda sala mbala moko `node scripts/powpow-registe
Referenced artifact was not completely inspected
- Script monene `scripts/powpow-register.mjs`: **ezali na dependance te**, esengi **Node >= 18**. Liboso ya kobanda sala mbala moko `node scripts/powpow-registe
Referenced artifact was not completely inspected
- Script monene `scripts/powpow-register.mjs`: **ezali na dependance te**, esengi **Node >= 18**. Liboso ya kobanda sala mbala moko `node scripts/powpow-registe
Referenced artifact was not completely inspected
- Script monene `scripts/powpow-register.mjs`: **ezali na dependance te**, esengi **Node >= 18**. Liboso ya kobanda sala mbala moko `node scripts/powpow-registe
Referenced artifact was not completely inspected
- Script monene `scripts/powpow-register.mjs`: **ezali na dependance te**, esengi **Node >= 18**. Liboso ya kobanda sala mbala moko `node scripts/powpow-registe
Referenced artifact was not completely inspected
- Script monene `scripts/powpow-register.mjs`: **ezali na dependance te**, esengi **Node >= 18**. Liboso ya kobanda sala mbala moko `node scripts/powpow-registe
Referenced artifact was not completely inspected
- Script monene `scripts/powpow-register.mjs`: **ezali na dependance te**, esengi **Node >= 18**. Liboso ya kobanda sala mbala moko `node scripts/powpow-registe
Referenced artifact was not completely inspected
- Script monene `scripts/powpow-register.mjs`: **ezali na dependance te**, esengi **Node >= 18**. Liboso ya kobanda sala mbala moko `node scripts/powpow-registe
The skill instructs the agent to execute host OS commands (start, open, xdg-open) on a locally generated payment page path. Even if the intended goal is opening a checkout page, this expands the agent from web/account assistance into local command execution, creating a command-injection and arbitrary program-launch surface if the returned path or surrounding shell invocation is influenced or malformed. In this context, payment/order creation is an external workflow and does not justify shell-level execution on the host.
The instruction says to always use the PowPow service voice/style, which can function as a fixed language/locale constraint in user-facing interactions. The file does not indicate that users may choose another language or opt in to this style, so it may violate the requirement not to force a specific language/locale without user choice.
The search keywords are broad and generic enough to match loosely related user requests, which can cause the skill to be invoked outside the user's clear intent. This is more concerning here because the notes describe an agent that can perform delegated actions such as registration, code submission, and ordering, so accidental invocation could trigger sensitive workflows or collect verification data in an unexpected context.
The manifest hard-codes the language as 'ln' without indicating user choice, fallback behavior, or justification. On its own this is usually a UX and safety-boundary issue, but in a skill that handles registration and payment-flow transitions, forcing a locale can increase the risk of user misunderstanding around consent, verification, and transactional steps.
The trigger guidance is broad enough to encourage automatic screenshot sending whenever a user vaguely wants to 'see' the product, rather than requiring a clear request for images. In a skill context, this can cause unintended disclosure of local packaged assets, irrelevant tool use, or responses that bypass normal user-consent and relevance checks.
The header comment promises a narrowly scoped set of persisted fields, but the implementation saves additional account and payment metadata such as userId, provider, amount, plan details, approval URL, and timestamps. This creates a security/privacy documentation mismatch: operators may handle the state file under weaker assumptions than warranted, increasing the chance of unintended exposure of sensitive workflow and billing data in the system temp directory.
The instructions say to 'bombaka ton moko' and 'voix echangama te', directing a fixed communication style in all turns. This imposes a specific language/voice behavior without offering the user a choice or opt-in, which matches the natural-language policy violation category.
The skill instructs the agent to write server-returned payment HTML to a temporary local file and launch it with a system command, but it does not require explicit user disclosure or confirmation for those local file and subprocess actions. Because the HTML originates from a remote payment API and is then opened locally, this expands the trust boundary and can surprise users or create opportunities for unsafe browser/process launches if the content or open-command handling is ever abused.
The PayPal flow likewise says the agent will generate a local HTML file and open it in the user's browser without clearly disclosing that file creation and browser launch will happen. Even in a legitimate payment context, undisclosed local file generation and process spawning are security-relevant actions that reduce transparency and can be risky if an attacker can influence the generated HTML or launch mechanism.
The screenshot description references the interface text '开始对话', suggesting the skill presents or relies on a specific language context. The file does not state that this language is optional, user-selected, or justified as a region-specific constraint.