Security audit

Student Orientation

Security checks across malware telemetry and agentic risk

Overview

This course-building skill is mostly coherent, but it asks for high-impact local install/update and skill self-update authority that users should review before installing.

Install only if you trust PersonWise to install and update a local CLI and to update this skill in place. Before use, confirm you are comfortable with browser OAuth, uploading selected course materials to PersonWise, using existing course credits, and any requested publication or link-access changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes shell-capable operations but does not declare permissions, which undermines least-privilege review and can cause the host to grant more capability than users expect. In this file, shell access is used to run installation, update, auth, and course-management commands, so the undeclared capability materially increases trust and audit risk.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The manifest describes a content-generation skill, but the body also directs software bootstrap, upgrade, filesystem modification, and external artifact retrieval. That mismatch is dangerous because users may authorize an orientation/course skill without realizing it can install or update executables, creating a path to unexpected code execution and supply-chain exposure.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The script installs or replaces a local executable under LOCALAPPDATA, which is a privileged behavioral expansion far beyond the declared student-orientation/course-creation purpose. Even though it includes checksum validation and some filesystem safety checks, bundling an installer/updater in a content-generation skill creates an unjustified code execution path and materially increases supply-chain and persistence risk for users.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code reaches out to an external domain to download a release artifact, a capability not justified by the stated educational-content function of the skill. Although the artifact is pinned by size and SHA-256, the network retrieval still introduces unnecessary supply-chain exposure and covert capability expansion in a context where users would not expect software download behavior.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: This script downloads, verifies, and installs a standalone executable from a remote release site, which is unrelated to the declared student-orientation/course-creation function of the skill. That mismatch is dangerous because it expands the skill from content generation into software deployment, creating an unnecessary supply-chain and local code execution path that a user would not reasonably expect from the stated purpose.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The file implements install, upgrade, and rollback behavior for a local binary, including target path selection, archive download, extraction, and replacement of an executable. Embedding this capability in an educational-content skill is inconsistent with the manifest and materially increases risk by enabling unexpected modification of the user's environment under the guise of a benign learning workflow.

Vague Triggers

High

Confidence: 94% confidence
Finding: The manifest expands the trigger from student orientation to effectively any course-creation request, which weakens activation boundaries and can cause the skill to run in contexts the user did not intend. Because the skill can authenticate, upload files, create artifacts, and update tooling, overbroad invocation materially increases the chance of unintended privileged actions.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The out-of-scenario section explicitly authorizes reuse of the same workflow for other course tasks, making the skill's operational scope ambiguous beyond its stated purpose. In context, that means a narrowly branded skill can still perform account, file, publication, and update actions for unrelated requests, increasing the risk of accidental overreach.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: Enabling implicit invocation without tighter trigger constraints means the skill may activate based on broad or ambiguous user requests, even when the user did not clearly intend to invoke this course-building workflow. Because this skill transforms supplied materials into interactive instructional content, unintended activation could cause unreviewed source content to be processed or presented in contexts where a different skill should respond.

Self-Modification

High

Category: Rogue Agent
Content: printed update command, then retry the failed step once. - When both are outdated, update the CLI first, then the Skill. When the `action` is `personwise update skill --at <skill-directory> --approve-upgrade`, replace `<skill-directory>` with the directory of this installed Skill (the directory containing this Skill's SKILL.md). Never run `doctor` or a generic capability preflight to check freshness; the `update check` command above is the freshness check. Never ask more than once per component per
Confidence: 95% confidence
Finding: update skill

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.