End-User Software Training

• Outcome: Review
• Latest audit: Aug 5, 2026 · 5:47 PM UTC
• Version: 2.1.8

Overview

This skill is mainly a PersonWise course-creation workflow, but it can install/update a local executable and update its own installed skill files before use.

Review before installing. This skill is not clearly malicious, but installing it means a course request may lead to PersonWise OAuth, source-document uploads, use of existing course credits, installation or upgrade of a local PersonWise CLI, and possible in-place updates to this skill. Only use it if you trust PersonWise as the CLI and service provider and are comfortable approving those updates when prompted.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill invokes shell-capable behavior, including installation and update flows, but declares no permissions to the user. That creates a transparency and consent gap: users may trigger local command execution and software changes without clear prior disclosure of that capability.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The public description frames the skill as course creation from source materials, but the body also authorizes installing/upgrading executables, writing to local bin directories, and replacing existing binaries. This mismatch can bypass user expectations and increase the chance that a benign-seeming training request results in privileged local changes or supply-chain exposure.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This skill includes a bootstrap installer that downloads, verifies, and installs a Windows executable from an external release server, which is unrelated to the declared end-user software training purpose. Even though the script performs checksum and some filesystem safety checks, bundling software installation logic inside a training skill creates an unjustified capability for endpoint modification and payload delivery, making the mismatch itself highly suspicious.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script implements install, upgrade, and rollback behavior for a local executable under LOCALAPPDATA, including replacement of an existing binary after hash-based validation. For a skill whose stated function is creating grounded training courses, this local software management capability is unnecessary and materially increases risk by allowing persistence and binary replacement on the user's system.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill enables implicit invocation while providing only broad trigger language and a generic default prompt, which can cause the agent to activate this skill in situations beyond the author's intended scope. That increases the chance of unintended course generation, prompt hijacking through loosely related requests, or inappropriate use of supplied materials without clear user intent.

Self-Modification

High

• Category: Rogue Agent

Content

printed update command, then retry the failed step once.
- When both are outdated, update the CLI first, then the Skill.

When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace
`<skill-directory>` with the directory of this installed Skill (the directory containing this
Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the
`update check` command above is the freshness check. Never ask more than once per component per

• Confidence: 97% confidence
• Finding: update skill

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.