personwise/personwise-product-first-success
New users stall before their first success, and every stalled setup costs activation. Turn your setup guides and manuals into an interactive digital-human quick start guide that walks users to first successful use and answers their questions along the way. High-risk steps always point back to qualified on-site confirmation — the course guides, it never certifies.
66
83%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The bundled bootstrap scripts fetch and install a remote executable at runtime from https://releases.personwise.ai/cli/v1.1.6/personwise_1.1.6_windows_amd64.zip (and the shell script uses https://releases.personwise.ai/cli/v1.1.6/$artifact), which is downloaded during skill execution and then installed/executed, so remote code is being fetched and run.
Where we found it
releases.personwise.ai
dependency · 2 sites
The bootstrap.sh script downloads and executes the PersonWise CLI binary from releases.personwise.ai at runtime (line 132-134), and the service descriptor declares this as the release origin, confirming it as a runtime dependency fetched and executed by the plugin.
assets/bootstrap.sh
132
url="https://releases.personwise.ai/cli/v1.1.6/$artifact"
assets/service-descriptor.signed.json
3
"release_origin": "https://releases.personwise.ai/cli/"
- Audited
- Security analysis