Partner Training

• Outcome: Review
• Latest audit: Aug 5, 2026 · 6:44 PM UTC
• Version: 2.1.8

Overview

This skill can create the requested training courses, but it also installs and updates local PersonWise software and can update the installed skill itself, so it needs Review before installation.

Install only if you are comfortable letting the skill use PersonWise OAuth, upload the materials you select, consume existing course credits for requested courses, and install or update a local PersonWise CLI. Review any prompted update command carefully, especially commands that update the installed skill itself.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill invokes shell/CLI operations but does not declare permissions for shell access. That creates a transparency and policy-enforcement gap: a host or reviewer may believe the skill is limited to content generation while it can execute local commands, install software, and manipulate files. In this context, the hidden capability is more dangerous because the skill also performs authentication, software bootstrap, and local file handling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description frames the skill as partner-training/course creation, but the instructions also authorize downloading, installing, upgrading, and validating a CLI and modifying local filesystem state. This is a classic description-behavior mismatch that can bypass user expectations and trust boundaries, leading users to approve a content task that actually performs privileged software-management actions. The risk is elevated because the skill instructs bootstrap and upgrade flows from external origins and persistence into user-local executable paths.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This skill is described as a partner-training/course-creation capability, yet the bundled PowerShell script downloads, verifies, extracts, and installs a native executable into the user's local application directory. Even though the script includes approval gating, hash checks, and some anti-tamper controls, shipping an installer is outside the declared purpose and materially expands the attack surface by introducing code deployment on the host. In the context of a training skill, this mismatch makes the behavior more suspicious and dangerous because users would not reasonably expect local binary installation from course-generation functionality.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The script implements install, upgrade, and rollback logic for a Windows executable, including replacement of an existing binary under LOCALAPPDATA. That is a privileged local-software-management capability unrelated to the stated training-content purpose, so it creates unnecessary risk of unauthorized code deployment, persistence, or supply-chain abuse if the distribution endpoint or release process is compromised. The skill context increases the severity because embedding software lifecycle management inside a learning-content skill is unjustified and likely to violate user expectations.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script downloads, verifies, and installs a local executable from a remote release service, which is a privileged software-management capability unrelated to a partner-training/course-generation skill. Even though the bootstrap includes integrity checks and requires explicit approval flags, embedding installer behavior inside a training skill materially expands the attack surface and creates an opportunity for unauthorized code deployment under the guise of normal skill usage.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: This code manages install, upgrade, and rollback flows for a binary in the user's local bin directory, behavior that is not justified by the stated purpose of producing grounded interactive training content. In the skill context, this mismatch is especially concerning because users and reviewers would not expect executable lifecycle management in a content-oriented skill, making the capability easier to misuse or conceal.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill enables implicit invocation while its scope is broad and only loosely constrained by trigger language, including a catch-all statement that it is 'not limited to this scenario' and can handle other course creation requests. This can cause the agent to auto-select the skill in unintended contexts, increasing the chance of processing sensitive or unrelated materials under the wrong workflow and expanding the attack surface for prompt/skill routing abuse.

Self-Modification

High

• Category: Rogue Agent

Content

printed update command, then retry the failed step once.
- When both are outdated, update the CLI first, then the Skill.

When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace
`<skill-directory>` with the directory of this installed Skill (the directory containing this
Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the
`update check` command above is the freshness check. Never ask more than once per component per

• Confidence: 96% confidence
• Finding: update skill

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.