Employee Onboarding Course

• Outcome: Review
• Latest audit: Aug 5, 2026 · 5:44 PM UTC
• Version: 2.1.8

Overview

This skill can create PersonWise onboarding courses, but it also installs and updates local software and can update its own skill files, so users should review it carefully before installing.

Install only if you intend to use PersonWise's SaaS and are comfortable with a skill that may install or update the PersonWise CLI, upload user-selected onboarding materials, consume existing course credits, and update its own installed skill files after approval. Keep course access private unless you deliberately request link sharing or submission.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes shell-capable behavior (`personwise` CLI plus bundled bootstrap scripts) without declaring corresponding permissions, which creates a transparency and consent gap. Users may expect a content-generation skill, but the workflow can execute local commands and install software, increasing the risk of unintended system changes or misuse if the skill is triggered unexpectedly.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is course creation, but the documented workflow also installs/upgrades executables, modifies local binaries, and interacts with the filesystem. That mismatch is dangerous because it hides materially different capabilities behind an education-oriented description, which can mislead users and policy systems about the real trust boundary of the skill.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The script installs or upgrades a local executable under LOCALAPPDATA by downloading and replacing personwise.exe, which is functionality unrelated to the skill's declared purpose of creating onboarding/course content. Even though it includes some safety checks such as explicit approval flags, hash validation, and anti-reparse-point checks, bundling a binary bootstrapper inside a content-generation skill expands the attack surface and creates an unexpected code execution path for users or agents invoking the skill.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code performs a remote download of a ZIP archive from releases.personwise.ai, extracts an executable, verifies hashes, and installs it locally. In the context of a learning-content skill, this remote bootstrap behavior is unjustified and dangerous because it enables delivery of executable code to the endpoint, creating a supply-chain and unexpected-execution risk even if the current implementation attempts integrity checks.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This script downloads, verifies, and installs a native executable from a remote release server, behavior that is unrelated to the skill's declared purpose of generating onboarding courses from supplied materials. Even though the installer includes integrity checks and explicit approval gates, bundling software installation into a content-generation skill expands the attack surface and enables unexpected code deployment in environments that may trust the skill for only educational functionality.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The file implements install, upgrade, and rollback logic for a PersonWise executable, which is unjustified by the stated course-authoring/onboarding use case. In the skill context, this mismatch is especially dangerous because users or hosting systems may grant trust to a benign-seeming training skill while it performs persistent local software modification, creating a supply-chain and unexpected-execution risk.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The manifest broadens the trigger scope from employee onboarding to essentially any course-creation request, which weakens least-privilege routing. A broadly triggered skill with shell/install/update behavior is more dangerous because it may activate in contexts where users did not intend to authorize software management or external service operations.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill can be implicitly invoked and its trigger scope is broad enough to match generic course-creation or onboarding requests, which increases the risk of accidental activation outside the intended employee-onboarding context. In a multi-skill environment, this can cause prompt routing confusion, unintended use of handbook-derived instructions, or inappropriate generation under the wrong skill boundary.

Self-Modification

High

• Category: Rogue Agent

Content

printed update command, then retry the failed step once.
- When both are outdated, update the CLI first, then the Skill.

When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace
`<skill-directory>` with the directory of this installed Skill (the directory containing this
Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the
`update check` command above is the freshness check. Never ask more than once per component per

• Confidence: 97% confidence
• Finding: update skill

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.