Developer Quickstart

• Outcome: Review
• Latest audit: Aug 5, 2026 · 5:45 PM UTC
• Version: 2.1.8

Overview

This skill is mostly coherent with PersonWise course creation, but it deserves review because it can install and update a local executable, update its own skill files, and perform account-backed course actions under broad triggers.

Install only if you are comfortable with PersonWise CLI installation or upgrades, browser OAuth to PersonWise, uploading selected course materials to PersonWise, and using existing course credits for requested course creation. Review any requested 'update skill' command carefully, decline unexpected updates, and be explicit about whether a course should stay private or be shared/published.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes shell/CLI operations but does not declare corresponding permissions, which weakens transparency and host-side policy enforcement. In this file, the shell capability is not incidental: it is central to installation, authentication, file upload, and course-creation flows, so the missing declaration can cause users or platforms to underestimate what the skill can do.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is course creation, but the actual behavior includes downloading, installing, upgrading, and replacing local executables and modifying the filesystem. That mismatch is dangerous because it hides a much more privileged operational footprint than a user would reasonably expect from a content-generation skill, increasing the chance of unintended software installation and trust-boundary violations.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script downloads, verifies, and installs a native executable into the user's LOCALAPPDATA path, which is a powerful system-modifying action unrelated to the declared purpose of creating a developer quickstart course. Even though it includes integrity checks and explicit approval flags, the capability materially expands the skill's authority and creates supply-chain and unexpected code-execution risk if invoked in the course-skill context.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This skill performs outbound network retrieval of a ZIP and writes a local executable, which is unjustified for a course-generation/developer-quickstart skill and violates least privilege. In context, hidden installation behavior is especially dangerous because users would expect educational content generation, not software deployment; this mismatch increases the chance of surprise execution and abuse through repackaging or future artifact compromise.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This script downloads, verifies, and installs or upgrades a local executable, which is materially unrelated to the declared purpose of a course-generation skill. Even though the installer includes integrity checks and explicit approval flags, embedding software installation capability inside an educational skill expands the attack surface and can lead to unexpected code deployment on the user's machine under misleading context.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code performs network retrieval of a release artifact and installs a runnable binary into the user's local bin directory, which is unjustified for a developer quickstart course skill. Although checksum validation is present, the core issue is capability mismatch: a content/course skill should not possess hidden software delivery and persistence functionality, because that can be abused to execute vendor-controlled code on endpoints.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill broadens itself from a specific developer quickstart workflow to essentially any course-creation request. Overbroad triggers are risky because they can cause the agent to apply powerful CLI, upload, and publishing behaviors in contexts the user did not intend, increasing chances of unauthorized actions or misuse of local materials and account credits.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The out-of-scenario section explicitly authorizes reuse for unspecified 'another course task,' which defeats clear scope boundaries. In this skill, that matters because the same workflow includes account actions, uploads, publication changes, and potential software updates, so ambiguous activation expands the blast radius beyond the named safe context.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill enables implicit invocation and uses broad trigger language for generating a course from API documentation, without meaningful scoping, exclusions, or safety constraints. This can cause the agent to activate in unrelated contexts or process unintended source material, increasing the chance of prompt-scope confusion, overbroad actions, or misuse in situations where a more specific skill should have been selected.

Self-Modification

High

• Category: Rogue Agent

Content

printed update command, then retry the failed step once.
- When both are outdated, update the CLI first, then the Skill.

When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace
`<skill-directory>` with the directory of this installed Skill (the directory containing this
Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the
`update check` command above is the freshness check. Never ask more than once per component per

• Confidence: 95% confidence
• Finding: update skill

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.