Security audit

PowPow రిజిస్ట్రేషన్ — బుడగ రిజిస్టర్ చేయండి, ప్రయాణ వృత్తాంతం మ్యాప్లో పిన్ చేయండి, డిజిటల్ హ్యూమన్తో చాట్ చేయండి

Security checks for vulnerabilities and agentic risk

Overview

This is a Telugu guide-only skill for helping users register and activate a PowPow account, with no local code execution or credential collection instructions.

Install this if you want Telugu guidance for PowPow registration and subscription activation. Do not share passwords, verification codes, or payment proof in chat; complete registration and payment only on the official PowPow pages linked by the skill.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description is entirely written as a Telugu-language assistant workflow and the referenced SKILL.md is described as containing language rules, but this README does not indicate that language use is optional or user-selectable. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file prescribes a fixed communication style and wording in Telugu for user interactions, but does not mention adapting to the user's preferred language or obtaining opt-in. This can violate language/locale policy when users are not Telugu speakers or have not requested Telugu output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This manifest explicitly sets the skill language to "te", and the visible metadata is written in Telugu without any indication that users can choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The entire skill reference is written in Telugu, while embedded product strings and identifiers suggest a broader, mixed-language product context rather than a clearly Telugu-only regional tool. There is no visible note that this document is intentionally locale-scoped or that users may choose another language, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document is written entirely in Telugu, which imposes a specific language choice on users reading the skill guidance. There is no indication that users can choose another language or that the locale restriction is required for a region-specific purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file's instructions and usage guidance are entirely in Telugu, which can force a specific language on operators or downstream users without any opt-in. The documented policy flags language or locale constraints unless the skill offers a choice or clearly justifies the restriction.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.