Sales Enablement Training

• Outcome: Review
• Latest audit: Aug 5, 2026 · 5:51 PM UTC
• Version: 2.1.8

Overview

The skill is not malicious on its face, but it bundles account-bound course creation with remote CLI installation and in-place skill updates that deserve user review before install.

Install only if you are comfortable with PersonWise creating courses through your account, using existing credits, uploading the materials you select, installing/upgrading a local PersonWise CLI, and potentially updating the skill itself after approval. Keep access private unless you intentionally request link sharing or publication.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill drives shell execution (`personwise`, bootstrap scripts, update commands) but does not declare permissions accordingly. That creates a transparency and governance gap: users and policy engines may believe the skill is content-only while it can install software, authenticate, and modify local state. In a skill ecosystem, undeclared execution capability is a real security issue because it weakens informed consent and permission enforcement.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is course creation from source materials, but the workflow also downloads release artifacts, installs/upgrades executables, validates hashes, and mutates the local filesystem. That mismatch is dangerous because users invoking a training skill may not expect software deployment behavior, increasing the chance of unintended code execution and host modification under a benign-seeming trigger. The broad operational behavior materially exceeds the declared business function.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This skill includes a PowerShell bootstrapper that downloads, verifies, and installs a local executable even though the declared purpose is sales enablement course creation. That capability is unrelated to the skill’s stated function and materially increases attack surface by enabling code deployment on the host, which is especially risky in a content-generation skill context where users would not reasonably expect local software installation.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script fetches a remote ZIP from releases.personwise.ai, validates hashes, extracts personwise.exe, and installs or replaces a local executable under LOCALAPPDATA. Even with checksum checks and approval flags, remote binary retrieval and local execution support are unjustified for a training-content skill and create a high-risk supply-chain and unauthorized software installation pathway if the distribution channel, release process, or surrounding trust assumptions are compromised.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This skill contains a bootstrap installer that downloads and installs an external PersonWise executable, which is unrelated to the declared purpose of generating sales enablement training content. Even though the script includes integrity checks and explicit approval gating, bundling remote software installation into a content-creation skill expands the trust boundary and can lead to unauthorized code execution in a context where users would not reasonably expect it.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The file implements remote software installation by fetching a release artifact over the network and placing an executable into the user’s local bin directory. In the context of a training-course skill, this capability is unjustified and dangerous because it introduces execution of downloaded code, persistence on disk, and supply-chain risk unrelated to the user’s expected workflow.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The metadata explicitly says the skill is 'not limited to this scenario' and can handle any other course creation request with the same workflow. This broadens activation beyond the declared sales-enablement use case, making it easier to invoke shell/install/update behavior in unrelated contexts where the user did not intend to authorize those actions. Overbroad trigger scope increases accidental execution and policy bypass risk.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The out-of-scenario section instructs the skill to service 'another course task' while retaining the same market-bound CLI workflow, authorization model, and operational behaviors. That expands the shell-capable, self-updating workflow into undefined domains without clear boundaries, increasing the chance of misuse or unintended invocation. In context, the danger is amplified because the workflow includes software installation and account-bound actions, not just content generation.

Self-Modification

High

• Category: Rogue Agent

Content

printed update command, then retry the failed step once.
- When both are outdated, update the CLI first, then the Skill.

When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace
`<skill-directory>` with the directory of this installed Skill (the directory containing this
Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the
`update check` command above is the freshness check. Never ask more than once per component per

• Confidence: 93% confidence
• Finding: update skill

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.