SOP and Process Training

• Outcome: Review
• Latest audit: Aug 5, 2026 · 5:58 PM UTC
• Version: 2.1.8

Overview

This skill can create PersonWise courses, but it also installs and updates local software and the skill itself under broad invocation rules, so users should review it before installing.

Install only if you are comfortable with PersonWise browser OAuth, use of existing course credits, uploading user-selected documents to PersonWise, and a bundled installer/updater that can place or replace the PersonWise CLI and update the skill itself. Prefer explicit invocation for SOP/process training requests and verify any install or upgrade prompt before approving it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill directs the agent to execute shell commands and install/update software, but the metadata does not declare corresponding permissions. This creates a hidden capability gap where a user or platform may believe the skill is limited to course generation while it can modify the host environment and invoke external tooling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The public description presents a content-creation skill, but the body authorizes bootstrap, install, upgrade, and executable replacement behavior on the local system. That mismatch can mislead users and orchestrators into invoking a skill with significantly greater operational power than expected, increasing the chance of unintended software changes or supply-chain exposure.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This script downloads a ZIP from a remote host, verifies hashes, and installs or replaces a local executable in %LOCALAPPDATA%\PersonWise\bin. Even though it includes integrity checks and explicit approval flags, that capability is unrelated to an SOP/process-training skill and materially expands the trust boundary by introducing software installation behavior into content-generation tooling.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill contains network-based download and local executable deployment logic that can place or replace personwise.exe on the user's system. In the context of a training-course creation skill, this is unjustified and dangerous because it enables code delivery and persistence behavior outside the user's expected interaction model, increasing the risk of supply-chain abuse or misuse if the distribution endpoint, hashes, or packaging process are compromised.

Vague Triggers

High

• Confidence: 89% confidence
• Finding: The description says the skill is 'not limited to this scenario' and can handle any other course creation request, which broadens invocation beyond the stated SOP/process scope. Overbroad routing increases the chance that the skill is auto-selected for unrelated requests and then exercises shell, auth, upload, and account actions outside the user's reasonable expectations.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The out-of-scenario section explicitly extends this skill to unrelated course tasks while preserving the same CLI, authorization, and automation behaviors. That makes activation boundaries ambiguous and can cause this skill to operate in contexts where its permissions, safety constraints, or user expectations no longer fit.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill enables implicit invocation while its activation scope is broad and loosely defined ('SOP training', 'process training', 'any other course creation request with the same workflow'). That creates a real risk the agent will auto-select this skill in unintended contexts and process sensitive internal procedure documents or generate authoritative-seeming training content without an explicit user request for this specific capability.

Self-Modification

High

• Category: Rogue Agent

Content

printed update command, then retry the failed step once.
- When both are outdated, update the CLI first, then the Skill.

When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace
`<skill-directory>` with the directory of this installed Skill (the directory containing this
Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the
`update check` command above is the freshness check. Never ask more than once per component per

• Confidence: 95% confidence
• Finding: update skill

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.