Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed PowPow account-registration helper with sensitive but purpose-aligned login and optional payment automation.
Install only if you want an agent to help create a PowPow account. Be aware that the flow handles your email, verification code, password, login token, and optional payment order; only proceed with payment when you initiated it, and run cleanup after finishing to remove local session state.
Referenced artifact was not completely inspected
- สคริปต์หลัก `scripts/powpow-register.mjs`: **ไร้ dependencies ต้องมี Node ≥ 18** ก่อนเริ่มให้รัน `node scripts/powpow-register.mjs status` หนึ่งครั้งเพื่อยืนย
Referenced artifact was not completely inspected
- สคริปต์หลัก `scripts/powpow-register.mjs`: **ไร้ dependencies ต้องมี Node ≥ 18** ก่อนเริ่มให้รัน `node scripts/powpow-register.mjs status` หนึ่งครั้งเพื่อยืนย
Referenced artifact was not completely inspected
- สคริปต์หลัก `scripts/powpow-register.mjs`: **ไร้ dependencies ต้องมี Node ≥ 18** ก่อนเริ่มให้รัน `node scripts/powpow-register.mjs status` หนึ่งครั้งเพื่อยืนย
Referenced artifact was not completely inspected
- สคริปต์หลัก `scripts/powpow-register.mjs`: **ไร้ dependencies ต้องมี Node ≥ 18** ก่อนเริ่มให้รัน `node scripts/powpow-register.mjs status` หนึ่งครั้งเพื่อยืนย
Referenced artifact was not completely inspected
- สคริปต์หลัก `scripts/powpow-register.mjs`: **ไร้ dependencies ต้องมี Node ≥ 18** ก่อนเริ่มให้รัน `node scripts/powpow-register.mjs status` หนึ่งครั้งเพื่อยืนย
Referenced artifact was not completely inspected
- สคริปต์หลัก `scripts/powpow-register.mjs`: **ไร้ dependencies ต้องมี Node ≥ 18** ก่อนเริ่มให้รัน `node scripts/powpow-register.mjs status` หนึ่งครั้งเพื่อยืนย
Referenced artifact was not completely inspected
- สคริปต์หลัก `scripts/powpow-register.mjs`: **ไร้ dependencies ต้องมี Node ≥ 18** ก่อนเริ่มให้รัน `node scripts/powpow-register.mjs status` หนึ่งครั้งเพื่อยืนย
Referenced artifact was not completely inspected
- สคริปต์หลัก `scripts/powpow-register.mjs`: **ไร้ dependencies ต้องมี Node ≥ 18** ก่อนเริ่มให้รัน `node scripts/powpow-register.mjs status` หนึ่งครั้งเพื่อยืนย
Referenced artifact was not completely inspected
- สคริปต์หลัก `scripts/powpow-register.mjs`: **ไร้ dependencies ต้องมี Node ≥ 18** ก่อนเริ่มให้รัน `node scripts/powpow-register.mjs status` หนึ่งครั้งเพื่อยืนย
Referenced artifact was not completely inspected
- สคริปต์หลัก `scripts/powpow-register.mjs`: **ไร้ dependencies ต้องมี Node ≥ 18** ก่อนเริ่มให้รัน `node scripts/powpow-register.mjs status` หนึ่งครั้งเพื่อยืนย
Referenced artifact was not completely inspected
- สคริปต์หลัก `scripts/powpow-register.mjs`: **ไร้ dependencies ต้องมี Node ≥ 18** ก่อนเริ่มให้รัน `node scripts/powpow-register.mjs status` หนึ่งครั้งเพื่อยืนย
The skill instructs the agent to write server-returned payment HTML to a local file and open it with a system command. Writing and rendering arbitrary HTML locally creates a risky bridge from remote content to local execution context, and opening it via system-level commands expands the blast radius to phishing, unsafe browser launches, or misuse of host capabilities.
The README’s user-facing instructions and behavior description are presented in Thai throughout, with no indication that users can choose another language or that Thai is required for a justified regional context. This can violate a language/locale policy when the skill effectively forces a specific language without user opt-in.
The skill prescribes a fixed Thai-only response style in its UX section without indicating that the agent should adapt to the user's language. While not a direct code-execution or data-exfiltration flaw, this can cause unsafe misunderstandings during account registration, payment, or credential handling if the user does not read Thai well. In a skill that brokers sign-up, login links, and payment flow, language rigidity increases the chance of user error and consent confusion.
The manifest sets the language to "th", which indicates a fixed language/locale choice. There is no accompanying note in this file that the language is optional, user-selectable, or justified as a Thailand-specific tool, so it appears to impose a locale without opt-in.
The skill instructions are fully presented in Thai, and there is no indication that the user can choose another language or that the skill is intentionally limited to Thai-speaking users for a documented regional reason. This can violate language/locale policy when a skill effectively forces one language without opt-in.
L014 states that payment actions and proof of payment remain entirely between the user and the official payment page, implying the agent does not participate beyond limited setup. However, elsewhere the documented behavior includes create-order and opening local payment/approval pages for Alipay or PayPal, which is active facilitation of the payment flow rather than not touching it at all.
The entire skill guidance is written in Thai and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
The documentation explicitly authorizes the agent to create payment orders, launch official payment pages, and track payment completion end-to-end. Even though it says the agent must not access the user's payment account directly, this still grants a sensitive financial workflow capability that can be abused for unauthorized purchases, coercive payment flows, or deceptive activation handling if user consent is not explicit and narrowly scoped.
The file describes writing HTML to a temporary local file and opening it, but does not present this as a clear user-facing warning or consent point. Users may not realize the skill will create local artifacts and invoke a browser/system opener as part of the payment flow, which undermines informed consent for a sensitive action.
The documented flow has the agent repeatedly polling subscription/payment state until activation. Continuous status monitoring of a financial transaction is a sensitive capability that can be misused for persistent tracking, excessive backend access, or silently completing payment-related flows beyond what the user expects.
The document explicitly instructs an agent to perform registration and login using public auth APIs, including flows involving JWTs, HttpOnly cookies, pending-user tokens, and third-party identity providers, but it provides no safety guidance for credential handling, session isolation, or user-consent boundaries. In an agent-executed context, omission of these safeguards can lead to unsafe collection, storage, replay, or misuse of authentication material and accidental account actions on behalf of users.
The activation guidance is overly broad and subjective ('use as needed' and when the user lacks a mental picture), so an agent could invoke this skill in situations where screenshots are unnecessary or not user-requested. That creates scope creep and can cause the assistant to disclose files, inject unrelated visual content into conversations, or overreach beyond the user's intent.
The file's user-facing help, command descriptions, and operational messages are entirely in Chinese, and the skill does not indicate any option to choose another language or opt in to this locale. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation.
The header comment promises that short-lived JWT tokens are deleted at flow end, but the implementation persists the token in a predictable temp-directory state file and only removes it when cleanup is run manually. If the process exits unexpectedly, the user forgets cleanup, or another local process/user can read the temp area despite file mode restrictions, the token may remain accessible longer than intended and enable unauthorized session reuse.