Security audit

Security Awareness Training

Security checks across malware telemetry and agentic risk

Overview

The skill is not clearly malicious, but it needs review because it can install and update PersonWise software, update its own skill files, authenticate to an external service, and upload course materials.

Install only if you trust PersonWise to install and update a local CLI, use browser OAuth, consume existing course credits for requested courses, upload selected materials to personwise.ai, and potentially update this skill after approval. Be especially careful with internal security policies or confidential training sources.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill invokes shell/CLI operations, including installation, authentication, uploads, and updates, but does not declare permissions to match those capabilities. That mismatch can bypass user expectations and weaken platform trust boundaries because a course-generation skill is able to execute local commands and modify environment state.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The manifest describes a training-course creation skill, but the instructions also bootstrap, install, and upgrade a local executable, modify the filesystem, and manage software lifecycle. This is dangerous because users may authorize seemingly harmless content-generation behavior while the skill performs privileged operational actions outside the declared purpose.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The manifest expands beyond the listed security-awareness trigger phrases by stating it can handle any other course-creation request with the same workflow. That overly broad activation scope increases the chance the skill is invoked in contexts the user did not intend, including contexts where file upload, account use, or CLI execution would be inappropriate.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The skill hard-codes use of a specific international service and instructs the agent never to switch service, endpoint, issuer, or resource. This reduces user control over data handling and locale choice, and may cause sensitive materials to be sent to a provider or jurisdiction the user did not explicitly approve.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill enables implicit invocation without any visible trigger constraints or narrowing conditions, so it may be auto-selected in situations broader than intended. Because this skill can transform supplied materials into training content, overly broad activation increases the chance of unintended use, prompt/context confusion, or accidental processing of sensitive policy documents in workflows that did not explicitly request this skill.

Self-Modification

High

Category: Rogue Agent
Content: printed update command, then retry the failed step once. - When both are outdated, update the CLI first, then the Skill. When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace `<skill-directory>` with the directory of this installed Skill (the directory containing this Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the `update check` command above is the freshness check. Never ask more than once per component per
Confidence: 96% confidence
Finding: update skill

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.