personwise/personwise-developer-quickstart
Developers abandon APIs that do not return a first success fast. Turn your API documentation and SDK guides into an interactive digital-human developer quickstart that takes them from credentials to their first successful API call — with code carried exactly from your docs, never improvised. Version-stamped and askable, so the tutorial answers follow-up questions your docs cannot.
72
90%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The Skill's bundled bootstrap scripts (invoked from SKILL.md) download and install a remote executable at runtime from https://releases.personwise.ai/cli/v1.1.6/personwise_1.1.6_windows_amd64.zip (and the related URL "https://releases.personwise.ai/cli/v1.1.6/$artifact" in assets/bootstrap.sh), which fetches remote code that is then extracted/installed and thus executes remote code at runtime.
Where we found it
https://releases.personwise.ai/cli/v1.1.6/$artifact
url · 2 sites
The bootstrap.sh script downloads a platform-specific CLI executable from releases.personwise.ai at runtime, verifies its SHA256 checksum, extracts it, and installs it to ~/.local/bin/personwise for execution.
assets/bootstrap.sh
132
url="https://releases.personwise.ai/cli/v1.1.6/$artifact"
assets/bootstrap.sh
134
curl --disable --fail --silent --show-error --proto '=https' --tlsv1.2 --connect-timeout 10 --max-time 300 --max-filesize "26214400" --output "$archive" "$url"
- Audited
- Security analysis