Security audit

Internal Change Adoption Course

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly coherent with PersonWise course creation, but it needs review because it can install and update local executables, update the installed skill itself, and activate broadly for course requests.

Install only if you trust PersonWise to receive the course materials and to provide the local CLI. Before use, confirm any CLI or skill update, review whether broad implicit invocation is acceptable in your environment, and keep courses private unless you intentionally request link or public access.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes shell/CLI operations, including installation and update commands, but declares no permissions or equivalent capability boundary. That creates a transparency and consent gap: an operator or orchestrator may treat the skill as content-only while it can actually modify the local environment and invoke external services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The advertised behavior is course creation from supplied materials, but the workflow also installs/upgrades software, writes to user-local bin directories, and replaces executables. That mismatch can bypass user expectations and policy controls, making it easier to smuggle privileged system changes under a benign-seeming educational skill.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This PowerShell bootstrap script downloads, verifies, extracts, and installs a Windows executable into the user's profile, which is unrelated to the stated purpose of generating grounded course content. Even though it includes several integrity checks such as pinned hashes, size checks, and some filesystem safety checks, it still introduces software installation behavior into a content-generation skill, expanding the trust boundary and enabling code execution on the host if the mechanism or release pipeline is abused.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script provides install, upgrade, and rollback logic for a local executable, including replacement of an existing binary, despite the skill being described as an internal change-adoption course authoring tool. In this context, bundling software deployment capability is unjustified and dangerous because it allows a skill invocation path associated with benign educational use to modify the local environment and establish executable persistence.

Vague Triggers

High

Confidence: 89% confidence
Finding: The manifest says the skill is 'not limited to this scenario' and can handle any other course creation request, which weakens trigger specificity and expands activation scope beyond the named use case. Overbroad invocation increases the chance the skill runs in contexts where its shell/install/update behaviors are unnecessary or unsafe.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The skill first says it should be used only for specific internal-change requests, then elsewhere broadens itself beyond that scenario. This ambiguity can cause accidental invocation and makes policy enforcement harder, especially because the skill can perform environment-changing CLI actions.

Vague Triggers

High

Confidence: 93% confidence
Finding: The out-of-scenario section authorizes reuse for 'another course task' without concrete limits, effectively turning a niche skill into a general-purpose course automation wrapper. In context, that is more dangerous because the same wrapper can install/update software, upload files, and act on external services in situations not anticipated by the original trust decision.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The skill is configured with `allow_implicit_invocation: true` and broadly scoped trigger language for course creation, which can cause the agent to activate in situations the user did not clearly intend. Unintended activation can route unrelated prompts into this skill’s workflow, increasing the chance of inappropriate data use, confusing responses, or bypass of more suitable skills.

Self-Modification

High

Category: Rogue Agent
Content: printed update command, then retry the failed step once. - When both are outdated, update the CLI first, then the Skill. When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace `<skill-directory>` with the directory of this installed Skill (the directory containing this Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the `update check` command above is the freshness check. Never ask more than once per component per
Confidence: 95% confidence
Finding: update skill

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.