Sales Onboarding

• Outcome: Review
• Latest audit: Aug 5, 2026 · 5:53 PM UTC
• Version: 2.1.8

Overview

The skill appears to support PersonWise course creation, but it also installs and updates local software and can update the skill itself, so it needs Review before installation.

Install only if you are comfortable letting this skill use PersonWise OAuth, consume existing course credits for requested courses, upload user-selected materials, publish or change access when requested, install or upgrade the PersonWise CLI locally, and run an approved update that can replace the installed skill. Review the install and update prompts carefully, and avoid broad or implicit use unless you intended to create or manage a PersonWise course.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill invokes shell-based installation and operational commands despite having no declared permissions, creating a hidden capability gap between what the platform may expose to users/reviewers and what the skill actually attempts to do. This is dangerous because it can lead to unexpected execution of local commands, software installation, and account-affecting actions without clear upfront permission scoping.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The published description presents the skill as a course-creation workflow, but the body authorizes bootstrap, upgrade, filesystem writes, executable replacement, and software lifecycle management. That mismatch undermines informed consent and makes it easier to smuggle privileged local actions under a benign training-oriented description.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script downloads and installs a native executable even though the skill is described as a sales-onboarding/course-creation capability. While the bootstrap includes several integrity checks and explicit approval gates, the presence of unrelated software installation functionality materially expands the skill's attack surface and violates user expectations about what the skill should do. In this context, hidden or unnecessary installer behavior is dangerous because it can be used to introduce persistent local code execution under the user's account.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: This skill contains an installation and upgrade path for a local binary that is not justified by its stated onboarding/course-authoring function. Even with checksum validation and HTTPS, bundling software deployment into a content-oriented skill creates an unexpected execution pathway and increases the risk of supply-chain abuse, persistence, or misuse if the release endpoint or packaging process is ever compromised. The danger is amplified by the mismatch between declared purpose and actual capability, which can bypass user scrutiny.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The trigger text says the skill is for sales onboarding, then expands scope to 'any other course creation request,' making invocation boundaries ambiguous. Overbroad activation increases the chance the skill runs in contexts where users did not expect CLI installation, OAuth flows, credit consumption, or publication actions.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The out-of-scenario section explicitly permits handling other course tasks without defining hard boundaries, effectively turning a narrow skill into a general-purpose workflow. In security terms, this weakens least privilege and makes sensitive behaviors more likely to be invoked outside the reviewed scenario.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill enables implicit invocation while providing only broad trigger language and a general-purpose course creation scope, which can cause the agent to activate in situations the user did not clearly intend. This increases the risk of prompt-routing confusion, unintended access to supplied materials, or execution of the skill in adjacent contexts where its grounded-output constraints may not be sufficient.

Self-Modification

High

• Category: Rogue Agent

Content

printed update command, then retry the failed step once.
- When both are outdated, update the CLI first, then the Skill.

When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace
`<skill-directory>` with the directory of this installed Skill (the directory containing this
Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the
`update check` command above is the freshness check. Never ask more than once per component per

• Confidence: 99% confidence
• Finding: update skill

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.