Report Briefing

• Outcome: Review
• Latest audit: Aug 5, 2026 · 5:50 PM UTC
• Version: 2.1.8

Overview

The skill matches a PersonWise course-creation workflow, but it also installs and updates local software and can update the installed skill itself, so users should review it before use.

Install only if you intentionally want PersonWise to create courses through its CLI and SaaS account. Expect browser OAuth, possible use of existing course credits, upload of the files you select, and local installation or upgrade of the PersonWise CLI; review any prompted skill or CLI update before approving it, and verify courses remain private unless you explicitly request link access or publication.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill invokes shell/CLI operations but does not declare corresponding permissions, creating a mismatch between the capability it uses and the trust signal it presents to the host or reviewer. That can lead to unexpected command execution, installation, authentication, and filesystem actions under a skill that appears to be content-only.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is report briefing, but the workflow also performs software bootstrap, upgrades, filesystem writes, and binary management. This is dangerous because users may authorize a presentation workflow without realizing it can install or replace executables, materially expanding the attack surface and the consequences of compromise.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This skill includes a bootstrap installer that downloads, verifies, and installs a Windows executable into the user's local profile, which is unrelated to the declared report-briefing/course-creation function. Even though the script performs checksum and some integrity checks, the core issue is unauthorized software installation capability embedded in a mismatched skill, creating a strong supply-chain and unauthorized code-execution risk.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script makes an outbound network request to fetch a ZIP archive and then installs a local executable, granting this skill an unjustified pathway to place runnable code on the endpoint. In the context of a report-briefing skill, that capability is especially suspicious because it exceeds any reasonable need for content summarization and could be used to establish persistence or deliver unwanted software under the guise of a benign feature.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The skill broadens itself from a specific report-briefing use case to any course-creation request, weakening trigger boundaries and increasing the chance of unintended activation. Broader activation is risky here because the skill can authenticate, upload files, create remote artifacts, and potentially install or update tooling.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The out-of-scenario section explicitly authorizes reuse for undefined 'another course task,' which undermines least-privilege by extending a powerful workflow beyond its named purpose. In context, that matters because the same workflow includes account actions, uploads, publication changes, and installer/update paths that should not be opportunistically reused.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The manifest enables implicit invocation and pairs it with a broad description/default prompt that can match generic requests like whitepaper summaries or presentations. This can cause the skill to be auto-selected outside narrowly intended contexts, increasing the chance that users are routed into a powerful content-generation workflow without clear consent or trigger boundaries.

Self-Modification

High

• Category: Rogue Agent

Content

printed update command, then retry the failed step once.
- When both are outdated, update the CLI first, then the Skill.

When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace
`<skill-directory>` with the directory of this installed Skill (the directory containing this
Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the
`update check` command above is the freshness check. Never ask more than once per component per

• Confidence: 95% confidence
• Finding: update skill

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.