ClawHub
Back to skill

Security audit

Create a PersonWise Course

Security checks across malware telemetry and agentic risk

Overview

The skill fits its PersonWise course-creation purpose, but it needs review because it can install or update a local executable and update its own skill files during use.

Install only if you are comfortable with PersonWise's CLI being installed or updated in your user-local environment, browser OAuth being used for your PersonWise account, and course materials being uploaded to PersonWise when you request document-backed courses. Review update prompts carefully, especially any command that updates the skill directory itself.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill instructs the agent to use shell-capable operations and even perform installation/update actions, but it does not declare permissions accordingly. That creates a transparency and policy-enforcement gap: hosts or users may authorize a seemingly low-privilege skill without realizing it can execute commands and modify local tooling.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The declared description focuses on course creation, but the skill also directs the agent to install and upgrade executables, download artifacts, and write binaries into user-controlled PATH locations. That mismatch is dangerous because it conceals supply-chain and local-system modification behavior behind a business-task description, reducing informed consent and increasing the chance that powerful actions run in an unexpected context.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The default prompt and display text are broad enough to match many ordinary user requests to 'create a course,' while implicit invocation is enabled. This can cause the skill to trigger in situations the user did not explicitly intend, sending documents, topics, or images into a high-impact publishing workflow and increasing the chance of unintended data handling or actions.

Self-Modification

High
Category
Rogue Agent
Content
printed update command, then retry the failed step once.
- When both are outdated, update the CLI first, then the Skill.

When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace
`<skill-directory>` with the directory of this installed Skill (the directory containing this
Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the
`update check` command above is the freshness check. Never ask more than once per component per
Confidence
92% confidence
Finding
update skill

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.