Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent PowPow registration helper, but it handles sensitive account and optional payment workflow data that users should share only deliberately.
Install only if you are comfortable letting the agent help create a PowPow account. Treat passwords, email verification codes, one-click login links, and payment checkout links as sensitive; verify any Alipay or PayPal page yourself and run cleanup when finished.
Referenced artifact was not completely inspected
- Script chính `scripts/powpow-register.mjs`: **không phụ thuộc**, cần **Node ≥ 18**. Trước khi bắt đầu, chạy một lần `node scripts/powpow-register.mjs status`
Referenced artifact was not completely inspected
- Script chính `scripts/powpow-register.mjs`: **không phụ thuộc**, cần **Node ≥ 18**. Trước khi bắt đầu, chạy một lần `node scripts/powpow-register.mjs status`
Referenced artifact was not completely inspected
- Script chính `scripts/powpow-register.mjs`: **không phụ thuộc**, cần **Node ≥ 18**. Trước khi bắt đầu, chạy một lần `node scripts/powpow-register.mjs status`
Referenced artifact was not completely inspected
- Script chính `scripts/powpow-register.mjs`: **không phụ thuộc**, cần **Node ≥ 18**. Trước khi bắt đầu, chạy một lần `node scripts/powpow-register.mjs status`
Referenced artifact was not completely inspected
- Script chính `scripts/powpow-register.mjs`: **không phụ thuộc**, cần **Node ≥ 18**. Trước khi bắt đầu, chạy một lần `node scripts/powpow-register.mjs status`
Referenced artifact was not completely inspected
- Script chính `scripts/powpow-register.mjs`: **không phụ thuộc**, cần **Node ≥ 18**. Trước khi bắt đầu, chạy một lần `node scripts/powpow-register.mjs status`
Referenced artifact was not completely inspected
- Script chính `scripts/powpow-register.mjs`: **không phụ thuộc**, cần **Node ≥ 18**. Trước khi bắt đầu, chạy một lần `node scripts/powpow-register.mjs status`
Referenced artifact was not completely inspected
- Script chính `scripts/powpow-register.mjs`: **không phụ thuộc**, cần **Node ≥ 18**. Trước khi bắt đầu, chạy một lần `node scripts/powpow-register.mjs status`
Referenced artifact was not completely inspected
- Script chính `scripts/powpow-register.mjs`: **không phụ thuộc**, cần **Node ≥ 18**. Trước khi bắt đầu, chạy một lần `node scripts/powpow-register.mjs status`
Referenced artifact was not completely inspected
- Script chính `scripts/powpow-register.mjs`: **không phụ thuộc**, cần **Node ≥ 18**. Trước khi bắt đầu, chạy một lần `node scripts/powpow-register.mjs status`
Referenced artifact was not completely inspected
- Script chính `scripts/powpow-register.mjs`: **không phụ thuộc**, cần **Node ≥ 18**. Trước khi bắt đầu, chạy một lần `node scripts/powpow-register.mjs status`
The entire skill description and operational guidance are written in Vietnamese, and there is no indication that users may choose another language or that the locale restriction is intentional and justified. This can violate language/locale policy when the skill is presented to a broader user base without explicit opt-in.
The skill explicitly instructs the user to send a 6-digit email verification code back through the chat and supports handling passwords during agent-mediated registration. Even though it says passwords should be passed to the script via environment variable, there is no explicit user-facing warning that verification codes and any credentials shared in chat are sensitive and should only be provided if the user trusts the environment; this creates phishing-style collection risk and increases exposure if chat logs are retained or accessible to other tools.
The payment section directs the agent to create orders, open local files, and send users into Alipay/PayPal checkout flows without an explicit safety/privacy notice telling users to verify the destination, understand what data leaves the chat, and know that the agent must not handle their payment credentials. While the skill says the agent should not touch payment accounts, the UX still normalizes a high-trust payment handoff that could be abused or imitated by a malicious skill.
The manifest sets a fixed language value of "vi", which indicates the skill is constrained to Vietnamese. There is no accompanying note that this is optional, user-selectable, or justified as a region-specific requirement, so it appears to impose a language choice without opt-in.
This markdown file contains user-facing procedural guidance only in Vietnamese, and there is no indication that users can choose another language or that the skill is intentionally restricted to Vietnamese-speaking users. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
Across comments, errors, help text, and success messages, the skill consistently uses Chinese as the only user-facing language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.
The comment claims the status command shows no credentials, but cmdStatus only removes token and still prints the rest of the state object. That state can include approveUrl, subscriptionId, outTradeNo, email, userId, and other session-linked workflow data that may enable account tracking, payment-flow hijacking, or leakage of sensitive login-related material in logs or agent transcripts.
The Conversation UX section mandates a fixed 'powpow' tone and prescribes exact phrasing patterns, but the skill does not offer users any language or locale choice. In combination with the Vietnamese-only instructions and payment guidance oriented to specific regional channels, this creates a language/locale constraint without explicit user opt-in or justification.
The document instructs opening a locally generated payment or authorization page using OS shell commands (start, open, xdg-open) without an explicit warning that the file path must be trusted and verified first. In an agent workflow, if the generated file path is influenced by untrusted data or substituted by a malicious local file, this can lead users into executing or rendering attacker-controlled local content that mimics a payment page or abuses local file handling.
The documentation says the state file stores only email, username, nickname, JWT token, order number, and workflow step. In practice, later code saves extra fields such as codeSentAt, registeredAt, userId, provider, package, amount, subscriptionId, approveUrl, plan details, and refreshedAt, so the comment is materially narrower than the implementation.