Compliance Training

• Outcome: Review
• Latest audit: Aug 5, 2026 · 5:42 PM UTC
• Version: 2.1.8

Overview

The skill is mostly coherent for creating PersonWise training courses, but it also installs and updates a local executable and can update its own installed skill files, so users should review it before installing.

Install only if you are comfortable with PersonWise CLI being installed or updated locally, browser OAuth being used, selected source documents being uploaded to PersonWise, existing course credits being consumed for requested courses, and the skill being able to update itself after approval. Review auto-invocation and the broad course-creation scope if you only want a narrow compliance-training tool.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill directs the agent to invoke shell-accessed CLI commands (`personwise`, bootstrap scripts, auth, update, file upload), but the metadata declares no corresponding permissions. That mismatch can cause the platform or reviewer to underestimate the skill's execution and filesystem/network reach, leading to unsafe deployment or unexpected command execution paths.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a compliance-training content generator, but it also includes software installation and upgrade behavior, binary replacement, archive handling, and local filesystem mutation. This is dangerous because users or orchestrators may approve it under a low-risk content-creation mental model while it actually performs privileged operational actions that expand the attack surface to supply-chain and local-environment compromise.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This script installs a local executable into the user's profile, which is unrelated to the declared compliance-training/course-creation purpose of the skill. Even though it includes integrity checks and explicit approval gates, bundling installer behavior inside a skill materially expands the trust boundary and creates unexpected code-execution capability if the skill is invoked in an automated environment.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill performs a network download of a release archive and then installs its contents, which is outside the advertised scope of compliance training. Although the download is pinned by URL, size, and SHA-256, it still introduces remote artifact retrieval and local execution staging into a context where users would not reasonably expect installer behavior, increasing supply-chain and abuse risk.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Providing install, upgrade, and rollback controls for a local executable is unjustified in a compliance-training skill and represents privileged operational behavior hidden behind educational functionality. The mismatch between declared purpose and actual capability makes the skill more dangerous because users or orchestrators may grant trust appropriate for content generation while unintentionally enabling software deployment.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The description says the skill is for compliance training but then broadens itself to 'any other course creation request,' which weakens activation boundaries. Overbroad invocation increases the chance the skill is triggered in contexts where its shell/install/update behaviors are unnecessary or unexpected, expanding exposure beyond the intended scenario.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The out-of-scenario section explicitly instructs the skill to handle unspecified 'another course task,' making routing and applicability ambiguous. In context, that ambiguity matters because this skill can install/update software and upload files, so accidental invocation outside the named compliance use case can produce unnecessary side effects.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The default prompt is broad enough to invoke the skill for generic course-building requests without clearly limiting it to compliance-training use cases or approved source materials. In a system with automatic skill routing, this can cause the agent to apply this workflow in unintended contexts, increasing the chance of ungrounded training content, policy misapplication, or handling sensitive internal documents outside the intended scope.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: Enabling implicit invocation without scope limits allows the orchestration layer to trigger this skill automatically even when user intent is ambiguous. Because the skill description explicitly says it is 'not limited to this scenario' and can handle other course creation requests, the lack of exclusion conditions makes accidental or over-broad activation more likely, which can lead to inappropriate content generation or misuse of sensitive policy material.

Self-Modification

High

• Category: Rogue Agent

Content

printed update command, then retry the failed step once.
- When both are outdated, update the CLI first, then the Skill.

When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace
`<skill-directory>` with the directory of this installed Skill (the directory containing this
Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the
`update check` command above is the freshness check. Never ask more than once per component per

• Confidence: 94% confidence
• Finding: update skill

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.