Product Change Adoption Course

• Outcome: Review
• Latest audit: Aug 5, 2026 · 5:49 PM UTC
• Version: 2.1.8

Overview

The skill is mainly a PersonWise course-creation workflow, but it also installs and updates local software and can update its own skill files with broad automatic activation.

Install only if you are comfortable with PersonWise installing or upgrading its local CLI, using browser OAuth, uploading the materials you select, spending existing PersonWise course credits, and changing or publishing courses when requested. Review update prompts carefully because they may change both the CLI and the installed skill instructions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill directs the agent to execute shell commands, perform installation, and manage local binaries, but the metadata does not declare corresponding permissions. That creates a trust gap where a user or host may believe the skill is documentation-only while it can modify the system and invoke external tooling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The stated purpose is course creation from source materials, but the skill also instructs the agent to download, install, upgrade, and replace executable artifacts and manipulate filesystem state. That mismatch can lead to users authorizing an educational workflow without realizing it includes software deployment and persistence changes on the host.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The bootstrap script downloads and installs a native executable into LOCALAPPDATA, which is unrelated to the declared course-generation skill behavior. Even though it includes hash checks and some filesystem safety checks, it still introduces local code installation and execution-enablement capability into a skill that users would not reasonably expect to modify their system, creating a significant supply-chain and trust-boundary risk.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code implements full software lifecycle management (install, upgrade, rollback gating, download, checksum verification, archive extraction, and binary replacement) despite the skill being described as a content/course creation tool. This mismatch makes the behavior more dangerous in context because it hides system-modifying functionality behind a non-administrative educational use case, increasing the chance of unauthorized or deceptive deployment of local executables.

Vague Triggers

High

• Confidence: 90% confidence
• Finding: The trigger scope is expanded from a named product-change-adoption use case to effectively any course creation request. Overbroad activation increases the chance the skill runs in contexts where its installation, OAuth, credit-consumption, and publishing behaviors are unexpected or inappropriate.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to bootstrap and upgrade software, including executing bundled install scripts, but the user-facing description does not warn that the workflow can modify the local system. Hidden install behavior undermines informed consent and can surprise users who expected only content generation.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill enables implicit invocation while providing only broad, marketing-style trigger language in metadata, which can cause the agent to activate in contexts the user did not clearly intend. That increases the chance of unrequested course generation, unintended data use from supplied materials, or confusing task hijacking by matching loosely related prompts such as product updates or course creation requests.

Self-Modification

High

• Category: Rogue Agent

Content

printed update command, then retry the failed step once.
- When both are outdated, update the CLI first, then the Skill.

When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace
`<skill-directory>` with the directory of this installed Skill (the directory containing this
Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the
`update check` command above is the freshness check. Never ask more than once per component per

• Confidence: 96% confidence
• Finding: update skill

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.