Security audit
Security checks for vulnerabilities and agentic risk
This skill is a guidance-only registration helper that discloses its payment and credential boundaries and does not include executable code.
Before installing, understand that this skill will direct users to PowPow’s website and subscription page and may show hosted screenshots. Users should complete registration and payment themselves in the browser or app, and should not share passwords, verification codes, or payment receipts with the assistant.
The manifest sets "language": "pt", which indicates a fixed language/locale for the skill. In this file there is no accompanying explanation that the skill is region-specific, nor any indication that users can opt into another language, so this appears to be a language-policy constraint imposed without documented user choice.
The document presents fixed Chinese login/error messages as expected behavior, including quoted strings users will encounter, but does not indicate that language is optional or limited to a China-specific deployment. This can violate language/locale policy because it normalizes a single language experience without user opt-in.
The troubleshooting table enumerates many user-facing messages in Chinese as the canonical outputs, while the rest of the document is in Portuguese. Without explicit justification that this skill is region-specific or that users can choose locale, this is a natural-language policy concern.
Lines L13-L14 explicitly state that a chat/command-line skill should neither pay on the user's behalf nor request payment proofs. Later troubleshooting guidance for failed WeChat activation directs the user to contact platform support after a delay, which is not itself contradictory, but in the context of manual confirmation could encourage operational flows involving receipt handling outside the stated boundary. This is a mild intent/documentation inconsistency rather than a code-level security behavior mismatch.
The document is primarily written in Portuguese, but it specifies fixed English UI text such as "Auto-renews. Cancel anytime." and "You're All Set!" as expected outputs. This can violate language/locale policy expectations because the skill does not indicate user opt-in to English or justify why English-only strings are required.
No suspicious patterns detected.
