Content Repurposing

• Outcome: Review
• Latest audit: Aug 5, 2026 · 5:43 PM UTC
• Version: 2.1.8

Overview

The skill is not clearly malicious, but it should be reviewed because it can install and update a native PersonWise CLI and the installed skill while being broadly invoked for course creation that may use account credits.

Install only if you are comfortable with this skill installing or upgrading the PersonWise CLI, opening browser OAuth, uploading user-selected course materials to PersonWise, using existing course credits for requested creations, and applying approved CLI or skill updates. Review prompts carefully before approving installs, upgrades, publishing, or broader access changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill invokes shell-capable behavior (`personwise`, bootstrap scripts, update commands) but does not declare corresponding permissions. This hides operational power from the user and host policy layer, reducing informed consent and making command execution harder to constrain or audit.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The stated purpose is content repurposing, but the skill also installs/upgrades software and modifies the local filesystem. That mismatch can trick users or orchestrators into authorizing a seemingly content-only skill that actually performs privileged system changes and remote binary acquisition.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The script downloads, verifies, extracts, and installs a native executable into the user's LOCALAPPDATA directory, which is a privileged capability unrelated to the declared content-repurposing/course-creation purpose of the skill. Even though the installer includes integrity checks and explicit approval gates, bundling hidden software installation behavior into an unrelated skill materially expands attack surface and creates a supply-chain and execution risk if the bootstrap path, release host, or future signed artifact process is compromised.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This code performs a network fetch of a ZIP containing an executable and then installs or replaces a local binary, which is an unnecessary and risky capability for a content-repurposing skill. Although the script pins TLS, disables redirects, and validates file size and SHA-256 hashes, the fundamental behavior still introduces remote code delivery and local executable deployment into a context where users would not reasonably expect it, making misuse or compromise significantly more dangerous.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script downloads, verifies, and installs a local executable from a remote release host, which is materially outside the declared purpose of a content-repurposing/course-creation skill. Even though it includes integrity checks and explicit approval gates, bundling software installation capability into an unrelated skill expands attack surface and can enable unexpected code introduction on the user's machine.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This file implements an executable bootstrapper that creates directories, downloads an archive, verifies hashes, extracts a binary, and places it into the user's PATH-like bin directory. In the context of a skill advertised for content repurposing, this is an unjustified capability mismatch that is dangerous because it introduces persistent executable code onto the endpoint under the guise of a non-installation workflow.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger text says the skill is 'not limited' to the named scenario and can handle any course creation request, which broadens activation beyond the user’s likely expectation. Overbroad routing increases the chance this powerful CLI-driving skill is selected for unrelated tasks and consumes credits or performs side effects unnecessarily.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The usage guidance is internally inconsistent: it says not to use the skill when there is no source content, then immediately says ordinary course creation is also handled through the same workflow. Ambiguous activation criteria can cause unintended invocation of a skill that authenticates, checks readiness, and may trigger install/update flows.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill normalizes automatic consumption of existing course credits for create requests without a prominent user warning at invocation time. In context, this is financially and operationally sensitive because broad triggers and automatic readiness/create steps can cause unintended paid resource usage.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill enables implicit invocation while advertising a broad, natural-language trigger surface for general course creation and content repurposing. This can cause the agent to invoke the skill in unintended contexts, expanding access to supplied materials and increasing the chance of unauthorized processing, prompt-routing mistakes, or policy bypass through overly permissive matching.

Self-Modification

High

• Category: Rogue Agent

Content

printed update command, then retry the failed step once.
- When both are outdated, update the CLI first, then the Skill.

When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace
`<skill-directory>` with the directory of this installed Skill (the directory containing this
Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the
`update check` command above is the freshness check. Never ask more than once per component per

• Confidence: 96% confidence
• Finding: update skill

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.