Back to skill

Security audit

Community Onboarding

Security checks across malware telemetry and agentic risk

Overview

This skill appears purpose-built for PersonWise course creation, but it also installs/upgrades a local executable and can update its own installed skill files during normal use.

Review this carefully before installing. It is not just a course-writing prompt: it can install or upgrade the PersonWise CLI, authenticate to PersonWise, upload user-selected materials, consume existing course credits, publish or change access when requested, and update the installed skill itself. Only use it if you trust PersonWise as the software and service provider and are comfortable approving those update/install steps explicitly.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill invokes shell/CLI operations but declares no corresponding permissions, creating a hidden execution capability that users and policy layers cannot accurately assess. In this file, those shell actions include installation, authentication, updates, file uploads, and publication steps, so the undeclared capability materially expands what the skill can do on the host.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The declared purpose is course creation, but the actual behavior includes bootstrapping and upgrading local software, downloading artifacts, and modifying local binaries. That mismatch is dangerous because a user authorizing content generation may unknowingly authorize system-level changes, increasing the chance of silent persistence, environment tampering, or supply-chain exposure.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The script installs or upgrades a local executable under %LOCALAPPDATA%\PersonWise\bin, which is unrelated to the declared purpose of a community-onboarding/course-generation skill. Even though it performs several integrity checks, bundling an installer in a content-generation skill materially expands the attack surface and creates unexpected code-execution capability in a context where users would not reasonably expect software installation.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The file downloads a ZIP from a remote host and installs an executable, giving the skill network retrieval and local binary deployment capabilities that are unjustified for a community-onboarding course skill. Although the script pins size and SHA-256 checksums and requires an approval flag, the core problem is hidden installer behavior in a non-installation skill, which can enable unexpected execution paths and erode trust boundaries.

Vague Triggers

High
Confidence
93% confidence
Finding
The description broadens scope from community onboarding to essentially any course creation request, weakening trigger boundaries and making over-invocation more likely. A broadly triggered skill with shell, auth, upload, and update behaviors is more dangerous because it may run in contexts where those powerful side effects were not expected.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The out-of-scenario section explicitly authorizes use for other course tasks without defining concrete boundaries, which undermines safe routing and least-privilege invocation. Because this skill can install/update software and interact with remote services, ambiguity in when it may activate increases the chance of unintended execution in unrelated workflows.

Self-Modification

High
Category
Rogue Agent
Content
printed update command, then retry the failed step once.
- When both are outdated, update the CLI first, then the Skill.

When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace
`<skill-directory>` with the directory of this installed Skill (the directory containing this
Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the
`update check` command above is the freshness check. Never ask more than once per component per
Confidence
97% confidence
Finding
update skill

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.