Security audit
Security checks for vulnerabilities and agentic risk
This is a reference-only Russian PowPow registration guide with public links and no code, credential collection, or local system access.
Install this if you want Russian-language help registering for PowPow. Expect the agent to send public product screenshot links and direct you to PowPow registration/subscription pages; verify the site and subscription terms yourself, and do not share passwords, verification codes, or payment details in chat.
The skill description is entirely framed in Russian and explicitly presents the skill as a registration assistant, but it does not state that language is optional, user-selectable, or region-specific. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
Suspicious Unicode normalization or mixed-script content
The manifest explicitly sets the language to "ru", while the surrounding metadata mixes Russian and Chinese descriptions and does not indicate that users can choose another language or that the skill is region-specific. This creates a natural-language policy concern because the skill appears to enforce a specific locale without documented opt-in or justification.
Suspicious Unicode normalization or mixed-script content
This markdown file contains user-facing operational guidance exclusively in Russian, while also embedding some English UI strings, and does not indicate that Russian is an intentional locale restriction. That can violate language/locale policy where skills should not force a specific language without user opt-in or justification.
This markdown file includes a Chinese login error string as the expected user-facing message, but does not state that the skill is intentionally limited to a Chinese-language or China-specific support context. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.
The troubleshooting table relies on Chinese-only messages such as 「用户名已存在」 and 「该账号已注销」 while the surrounding document is otherwise in Russian. Without an explicit locale constraint, this embeds a language-specific assumption that may conflict with organizational language-choice policy.
The guidance says screenshots should be used 'when necessary' and when a user 'does not know PowPow or needs to see what the finished product looks like,' which is broad enough to trigger image sharing in routine conversations without strong relevance checks. In a customer-facing agent, this can cause unsolicited external-link sharing, confuse users, and increase the chance of unnecessary disclosure of third-party hosted content.
The invocation table maps common conversational phrases such as 'what is PowPow' or 'what can I do after registration' directly to screenshot sharing, without requiring explicit consent, context validation, or minimizing disclosures. Because these are ordinary phrases, the agent may over-trigger and send screenshots in many benign conversations, creating spammy behavior and unnecessary dependence on external resources.
All instructional content and user-facing trigger examples are in Russian, and the file does not indicate that Russian is optional or required for a justified regional use case. This can violate language/locale policy when a skill implicitly forces one language without user opt-in.
No suspicious patterns detected.
