Security audit

Product First-Success Guide

Security checks across malware telemetry and agentic risk

Overview

The skill appears intended for PersonWise course creation, but it also installs and updates local software and can update its own skill files, which warrants Review before use.

Install only if you trust PersonWise to provide the CLI and future skill updates. Expect the agent to authenticate with PersonWise, upload the source materials you name, use existing course credits, create or modify courses, and possibly publish or change access when you request it. Review any install or update prompt carefully, especially commands that replace the local CLI or the skill directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes shell-capable behavior but does not declare permissions, which undermines transparency and consent around code execution. In this file, the shell capability is used for installation, authentication, updates, and course operations, so the missing declaration can cause users or orchestrators to authorize a seemingly content-only skill that actually performs local command execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The stated purpose is course creation from supplied materials, but the behavior includes downloading, installing, upgrading, and modifying local executables and filesystem locations. That mismatch is dangerous because users may invoke the skill expecting document-grounded content generation while unknowingly granting software supply-chain and local system modification actions.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This skill bundles a PowerShell bootstrapper that downloads, verifies, and installs a native executable into LOCALAPPDATA, which is unrelated to the declared purpose of generating grounded course content. Even though the script includes checksum and some filesystem safety checks, it still introduces software installation and persistence capability into a skill where users would not reasonably expect host modification, substantially increasing attack surface and trust risk.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script performs a network fetch of a ZIP archive from an external release host and installs the contained executable locally, giving the skill the ability to introduce code onto the endpoint. In the context of a course-creation skill, this capability is unjustified and dangerous because it enables persistence and execution of external binaries, creating a supply-chain and host-compromise risk even if the current artifact is pinned by hash.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This skill includes a bootstrap installer that downloads a remote tarball and installs an executable onto the user's system, which is unrelated to the stated purpose of generating a grounded course or first-success guide. Even though the script contains some integrity checks and approval gating, bundling software installation into an educational/content-generation skill creates an unjustified code-execution path and strongly suggests hidden capability expansion or supply-chain staging.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The file implements install, upgrade, and rollback behavior for a local executable, including replacement of binaries in a user bin directory. That capability is not justified by the declared skill function, so the danger comes from covert persistence and unauthorized software deployment rather than from a single unsafe shell primitive. In the context of a course-creation skill, this mismatch materially increases suspicion and risk.

Vague Triggers

High

Confidence: 93% confidence
Finding: The description broadens the trigger from a specific first-success guide to effectively any course-creation request. This increases the chance of over-invocation, causing a user intent that appears narrow and low-risk to route into a skill that performs authentication, uploads, publishing, and update/install operations.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill says to use it for setup-oriented requests, but elsewhere states it is not limited to that scenario, creating ambiguous invocation boundaries. Ambiguity is risky for agent routing because it can cause the skill to activate in contexts where its heavier behaviors—CLI auth, uploads, publishing, and updates—are unexpected or unauthorized by user intent.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill enables implicit invocation (`allow_implicit_invocation: true`) while its trigger scope is broad and not enforced in this file, allowing the agent to activate the skill based on loose semantic matches rather than explicit user intent. Because the skill transforms supplied documentation into an interactive course and is 'not limited to this scenario,' unintended activation could cause unreviewed content processing, prompt-scope expansion, or execution of a workflow the user did not actually request.

Self-Modification

High

Category: Rogue Agent
Content: printed update command, then retry the failed step once. - When both are outdated, update the CLI first, then the Skill. When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace `<skill-directory>` with the directory of this installed Skill (the directory containing this Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the `update check` command above is the freshness check. Never ask more than once per component per
Confidence: 97% confidence
Finding: update skill

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.