Security audit
Security checks for vulnerabilities and agentic risk
This is a guide-only registration helper that stays scoped to explaining PowPow signup, screenshots, errors, and subscription steps without collecting credentials or running code.
Install this if you want a Tagalog guide for PowPow registration and subscription activation. Users should still complete signup and payment only on the official PowPow pages and should not share passwords, verification codes, or payment credentials in chat.
The README is entirely written in Filipino and does not indicate that other languages are supported or that the language restriction is intentional for a region-specific audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
The notes field contains Chinese text while the file declares "language": "tl", creating a language inconsistency in natural-language metadata. This can violate language/locale policy because the skill content appears to force or assume a language different from the declared locale without user opt-in or justification.
This markdown file contains end-user guidance entirely in a specific language context, but it does not indicate that the user opted into Filipino or that the skill is region-specific. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern.
This markdown file includes a table of 'original error text in Mandarin' and repeated Mandarin-only messages users will encounter during registration and login. Under the policy, forcing a specific language without opt-in can be a natural-language policy concern when no alternative language option or regional justification is stated.
The instruction says to send a screenshot when the user has 'no concept' of Bubble or when it is necessary to 'see' the finished product, but it does not define clear boundaries for when that condition is met. This leaves activation to broad subjective judgment and could lead to screenshots being sent in situations beyond the intended scope.
The per-image usage guidance provides sample situations, but the trigger scope remains open-ended because it does not specify whether these are exhaustive or merely illustrative. Without negative examples or constraints, the skill may invoke screenshot sharing based on broadly similar everyday phrasing.
No suspicious patterns detected.
