Back to skill

Security audit

Customer Onboarding Course

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its course-creation purpose, but it should be reviewed because it can install or update a local CLI and update its own installed skill directory.

Install only if you are comfortable with PersonWise creating cloud courses from selected materials, consuming existing course credits, using browser OAuth, installing a local CLI, and updating the skill/CLI when the service requires it. Review update prompts carefully and avoid approving publication or link access unless you intend to share the course.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill invokes shell-capable behavior, including installation/bootstrap and CLI execution, but does not declare permissions accordingly. This creates a transparency and governance gap: a host or reviewer may authorize a content-generation skill without realizing it can execute local commands and modify the environment.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The stated purpose is course creation, but the behavior includes software installation, upgrades, binary download, checksum handling, extraction, and executable replacement. That mismatch is dangerous because users may consent to a pedagogical workflow while the skill also performs supply-chain and local-environment modification actions with materially different risk.

Vague Triggers

High
Confidence
88% confidence
Finding
The trigger and description explicitly broaden the skill beyond customer onboarding to essentially any course-creation request. Overbroad activation increases the chance the skill runs in contexts where its shell, auth, upload, and update behaviors were not expected or appropriately reviewed.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The out-of-scenario section weakens the skill boundary by authorizing use for unspecified other course tasks. In practice, this can bypass intent-based safeguards and cause the skill's more sensitive operational behaviors to be applied far outside the reviewed customer-onboarding use case.

Self-Modification

High
Category
Rogue Agent
Content
printed update command, then retry the failed step once.
- When both are outdated, update the CLI first, then the Skill.

When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace
`<skill-directory>` with the directory of this installed Skill (the directory containing this
Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the
`update check` command above is the freshness check. Never ask more than once per component per
Confidence
96% confidence
Finding
update skill

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.