Security audit
Security checks for vulnerabilities and agentic risk
This is a Burmese-language guidance-only skill for PowPow registration and subscription activation, with no code execution or hidden access behavior found.
Before installing, expect Burmese-language registration help for PowPow, including links to PowPow pages, external screenshot images, and subscription options. Do not share passwords, verification codes, or payment credentials in chat; use the PowPow browser or app pages directly for account creation and payment.
The store display name advertises broader product capabilities such as map-based social features and digital-human conversation, while the skill is described as registration and subscription guidance only. This can mislead users about what the skill actually does, increasing the risk of deceptive UX, mistaken consent, and trust abuse around account onboarding.
The manifest explicitly sets the skill language to "my" (Burmese/Myanmar), and the visible metadata such as display name and keywords are written only in that language. Under the policy, locale restrictions should either offer user choice or be clearly documented as justified for a region-specific skill, which is not stated here.
The entire skill document is written in Burmese and does not indicate that the user can choose another language or that the skill is restricted to Burmese-speaking users for a documented reason. This creates a natural-language locale policy concern because it implicitly imposes a specific language without opt-in.
The document presents user-facing behavior where the returned message is explicitly in Chinese (for example, "该账号未设置密码，请使用其他方式登录") while the surrounding documentation is in Burmese. This indicates a locale-specific output constraint without user opt-in or justification, which is a natural-language policy concern.
The entire guidance is written in Burmese/Myanmar language and includes prescribed user-facing phrasing, but it does not state that the skill is region-specific or that agents may adapt to the user's preferred language. This can violate language/locale policy when the skill is used with users who have not opted into that language.
The search keywords expand the apparent purpose of the skill to general social networking and travel-record functionality, which is broader than the declared registration-only behavior. Overbroad metadata can route users to a skill under false expectations and is a form of misleading capability representation.
The notes show the author understands some features belong to another skill, yet the listing still markets other out-of-scope features. That inconsistency indicates weak metadata governance and raises the likelihood of user deception or policy evasion through selective scoping disclosures.
This markdown file explains use of Google, Watcha, and Huawei account login, but it does not warn users that using these options may share authentication or profile data with third-party providers. Because markdown files should disclose behaviors that may affect user privacy, the omission is a documentation-level warning gap.
No suspicious patterns detected.
