Security audit

Lead Magnet

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent PersonWise course-creation integration, but it also installs and updates local executable software and can update the installed skill itself, which warrants Review before installation.

Install only if you trust PersonWise to provide and update a local CLI and you are comfortable with the agent using browser OAuth, uploading user-selected materials, creating courses with existing credits, and changing course access when requested. Review any install, upgrade, or skill-update prompt carefully, and avoid relying on implicit invocation for unrelated course work.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill invokes shell-based commands extensively (`personwise`, bootstrap scripts, update commands) but does not declare corresponding permissions. This creates a transparency and consent gap: the host or user may authorize the skill based on a benign content-creation description while the skill can execute local commands, install software, and modify the environment.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared purpose is course creation, but the workflow also performs software bootstrap, upgrade checks, binary installation, and local filesystem modification. That mismatch is dangerous because it hides materially different behavior from the user and increases the chance the skill is invoked in contexts where remote code retrieval and installation were not expected or appropriately reviewed.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill is described as a lead-magnet/course-creation tool, but this script installs or upgrades a local executable under the user's profile. That is a materially different capability from the declared purpose and creates an unexpected software-deployment path that could be abused to introduce persistent code execution. The script includes some integrity checks, but the core issue is the hidden, unjustified installer behavior within a non-installer skill.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The script downloads an archive from a remote host, verifies it, extracts an executable, and installs it locally, all of which exceed what is justified for generating course or lead-magnet content. Even with TLS and pinned hashes, this introduces unnecessary network retrieval and executable installation into a content skill, expanding the attack surface and enabling supply-chain or unexpected persistence risks if the delivery process or surrounding trust assumptions fail. The mismatch between stated functionality and actual capability makes the behavior more suspicious and more dangerous in this context.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This skill includes a bootstrap installer that downloads and installs a local executable, which is unrelated to the declared lead-magnet/course-generation purpose. Even though the script performs checksum checks and requires approval flags, bundling software installation capability into a content-creation skill creates a strong supply-chain and execution-risk mismatch and can be used to introduce unauthorized code onto the host.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script fetches a remote tarball over the network and installs a binary locally, despite the skill being described as a lead-magnet/course-creation tool. This capability materially increases risk because it enables remote code delivery and persistence on the user's machine, and the context mismatch makes the behavior especially suspicious rather than operationally necessary.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The description broadens activation from lead-magnet creation to essentially any course-creation request. Overbroad invocation scope is risky because it can cause the skill to activate in unrelated scenarios and then run its shell/install/update workflow on requests that did not clearly warrant those capabilities.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The out-of-scenario section explicitly instructs the skill to handle other course tasks without defining strong boundaries. In context, this extends a high-capability workflow beyond its named purpose, increasing the likelihood of unintended invocation and misuse of installation, update, authentication, and publishing operations.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill enables implicit invocation while its trigger scope is broad and marketing-oriented (e.g., any request about lead magnets, mini courses, or course creation). This can cause the agent to activate the skill in situations the user did not explicitly intend, potentially injecting the skill’s workflow and prompts into unrelated conversations and increasing the chance of unsafe autonomous behavior or prompt-scope confusion.

Self-Modification

High

Category: Rogue Agent
Content: printed update command, then retry the failed step once. - When both are outdated, update the CLI first, then the Skill. When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace `<skill-directory>` with the directory of this installed Skill (the directory containing this Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the `update check` command above is the freshness check. Never ask more than once per component per
Confidence: 97% confidence
Finding: update skill

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.