Security audit
Security checks for vulnerabilities and agentic risk
This is a Turkish-language guidance skill for PowPow registration and subscription activation, with no executable code and clear instructions not to collect credentials or perform payments for the user.
Install only if you want Turkish-language help registering for PowPow. Use the official PowPow pages for registration and payment, and do not share passwords, verification codes, or payment details in chat.
The manifest explicitly sets "language": "tr", which indicates a fixed locale. Under the policy, forcing a specific language without opt-in or clear region-specific justification is a natural-language policy violation; this file does not provide such a justification.
The file’s instructional content is predominantly in Turkish, which can impose a language constraint on users or operators if the skill is expected to be generally usable. There is no indication that Turkish is optional, user-selected, or justified by a region-specific requirement.
The document correctly says a chat/CLI skill must not perform payments, but it also enumerates concrete payment and order endpoints plus an Alipay simulated-payment fallback. In an adversarial or loosely governed agent environment, that operational detail can enable a future agent or integrator to invoke payment-related backend paths anyway, increasing the risk of unauthorized transaction attempts, order creation, or misuse of test/simulated flows.
The entire skill file is written in Turkish, while embedded user-facing messages are partly Chinese, and there is no indication that language choice is optional or limited to a specific Turkish-language context. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.
This markdown file contains operational instructions only in Turkish, which can violate a language/locale policy when the skill is not explicitly limited to Turkish-speaking users. There is no indication that the skill is region-specific or that users may opt into another language.
No suspicious patterns detected.
