Back to skill

Security audit

Customer Education

Security checks across malware telemetry and agentic risk

Overview

This skill appears to create PersonWise courses, but it also installs and updates a local CLI and can update the skill itself under broad invocation rules, so it should be reviewed before use.

Install only if you are comfortable with PersonWise receiving the course materials you select and with the skill installing or updating a local PersonWise CLI. Review update prompts carefully, keep courses private unless you explicitly want link/public access, and do not use it for account-specific support diagnosis or sensitive documents that should not leave your environment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill invokes shell-capable behavior (`personwise`, bootstrap scripts, updates) without declaring corresponding permissions, creating a capability/permission mismatch. This reduces transparency and consent, and can cause an agent or host to execute local commands, install software, or modify the environment under a skill that appears content-focused rather than system-affecting.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The declared purpose is customer education course creation, but the skill also instructs the agent to install and upgrade executables, download artifacts, validate binaries, and write into local bin paths. That mismatch is dangerous because users or policy systems may authorize the skill for a low-risk content task while it performs materially higher-risk system modification and software supply-chain actions.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The script downloads, verifies, and installs a native executable into the user's LOCALAPPDATA path, which is functionality unrelated to the declared customer-education/course-creation purpose of the skill. Even though it includes integrity checks and approval gates, introducing software installation behavior into a content skill expands attack surface, creates persistence on the endpoint, and violates least privilege and user expectation for this context.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
This code performs download, extraction, validation, and replacement of a local executable, including upgrade and rollback paths, despite the skill being described as customer-education content generation. In this skill context, such endpoint-modifying behavior is unjustified and therefore more dangerous, because users and reviewers would not reasonably expect a training/content skill to alter local binaries or establish an installed toolchain.

Vague Triggers

High
Confidence
90% confidence
Finding
The description expands scope from customer education into 'any other course creation request,' which weakens task boundaries and increases the chance of unintended invocation in unrelated contexts. Broad invocation scope is risky here because the skill carries shell execution, authentication flow handling, uploads, publishing, and self-update behaviors that should be tightly constrained to specific, user-understood scenarios.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The usage guidance relies on broad trigger phrases like customer training and support deflection without strong disambiguation rules. In context, this can cause over-triggering of a skill that may authenticate to external services, install/update local software, and upload materials, making accidental invocation more dangerous than a normal wording issue.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill enables implicit invocation while providing only broad, marketing-style trigger language and no concrete guardrails in this file. That increases the chance the agent will activate in situations beyond the user's intent, causing unintended use of course-generation behavior on arbitrary content and expanding the attack surface for prompt or content-driven misuse.

Self-Modification

High
Category
Rogue Agent
Content
printed update command, then retry the failed step once.
- When both are outdated, update the CLI first, then the Skill.

When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace
`<skill-directory>` with the directory of this installed Skill (the directory containing this
Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the
`update check` command above is the freshness check. Never ask more than once per component per
Confidence
95% confidence
Finding
update skill

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.