Interactive Product Explainer

• Outcome: Review
• Latest audit: Aug 5, 2026 · 5:46 PM UTC
• Version: 2.1.8

Overview

This skill is mostly a coherent PersonWise course-creation workflow, but it also installs or upgrades a local executable and can update its own installed skill code during normal use.

Install only if you are comfortable with PersonWise creating or updating a local CLI executable, using browser OAuth, uploading selected product materials to PersonWise, consuming an existing course credit, and potentially updating the installed skill itself after approval. Review the installer/update prompts carefully and avoid implicit use for unrelated course tasks unless you intend that broader authority.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill invokes shell-capable behavior but does not declare corresponding permissions, which weakens user awareness and any permission-gating the platform may rely on. In this specific skill, that matters because the workflow references CLI setup and usage, so hidden shell capability can lead to local command execution without clear disclosure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared purpose is content/course creation, but the behavior reportedly includes installing or replacing a local executable, downloading release artifacts, and modifying user bin directories. That is a significant expansion of trust and attack surface: a user invoking a content skill may unknowingly permit local software installation or replacement, creating supply-chain and persistence risk.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The manifest presents a product-explainer skill, but the text broadens it to handle any course-creation request. That mismatch can bypass users' expectations and policy routing, causing the agent to act outside the reviewed scenario and process different kinds of content or actions than intended.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The out-of-scenario section explicitly authorizes use for other course tasks, overriding the narrowly described scenario. This increases the chance of the skill being invoked in contexts with different data sensitivity, compliance needs, or approval requirements, while still carrying the same operational powers.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This skill is described as a product-explainer/course-creation workflow, but the file implements a bootstrap installer that downloads, verifies, and installs a native executable into the user's LOCALAPPDATA directory. That mismatch materially increases risk because users invoking a content-generation skill would not reasonably expect local software installation or binary replacement, creating an opportunity for unauthorized system modification and trust-boundary abuse.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script can create a local bin directory, place personwise.exe there, and replace an existing executable after validating only specific hashes, which gives the skill direct capability to modify the host environment. For a product-explainer skill, this capability is unjustified and dangerous because it expands impact from content generation into persistent code deployment, making accidental misuse or malicious repurposing far more severe.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The workflow explicitly broadens the skill beyond its declared product-explainer purpose by stating it can handle other course-creation requests with the same workflow. That scope drift can cause the agent to perform actions outside user and platform expectations, weakening safety controls tied to the declared capability and increasing the chance of misuse or policy bypass.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger language is broad and ambiguous, especially where it says the skill is not limited to the named scenario. Ambiguous invocation criteria can cause unintended execution, including running CLI-related workflows for requests that should have been handled by a safer or more specific skill.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The out-of-scenario instructions remove clear trigger boundaries and effectively permit the same operational workflow for unspecified tasks. In a skill that uses authenticated CLI operations and potentially local setup steps, unclear scope makes accidental overreach more dangerous than in a purely informational skill.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill enables implicit invocation without any narrowly scoped activation condition, so the agent may trigger this skill in contexts broader than intended. Because the skill claims it can handle 'any other course creation request with the same workflow,' its scope is effectively widened, increasing the chance of unintended activation, prompt-context hijacking, or use on unverified materials despite the description's constraints.

Self-Modification

High

• Category: Rogue Agent

Content

printed update command, then retry the failed step once.
- When both are outdated, update the CLI first, then the Skill.

When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace
`<skill-directory>` with the directory of this installed Skill (the directory containing this
Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the
`update check` command above is the freshness check. Never ask more than once per component per

• Confidence: 97% confidence
• Finding: update skill

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.