personwise/personwise-report-briefing
Reports get skimmed for one chart and misquoted forever. Turn your whitepaper or benchmark report into an interactive digital-human briefing course that teaches the findings with the method and the limits attached — and answers audience questions the PDF cannot. No causal leaps, no predictions beyond what the report states.
71
89%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
2 low severity findings. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
SKILL.md requires the agent to build the course from user-supplied/explicitly selected report content (e.g., “report, whitepaper, or benchmark study” and “Create from a topic or supplied text” with `knowledge_source_mode=open`), so outsider-authored free text can be ingested directly into the runtime via the user’s provided material.
Where we found it
user-supplied report/whitepaper/benchmark study text (knowledge_source_mode=open)
content-type · 4 sites
The skill instructs the agent to build courses from user-supplied reports, whitepapers, benchmark studies, or free text via knowledge_source_mode=open, directly ingesting outsider-authored content into the runtime.
SKILL.md
13
Build an interactive digital-human briefing course from a report, whitepaper, or benchmark study.
SKILL.md
150
- **Create from a topic or supplied text:** `knowledge_source_mode=open`.
SKILL.md
151
- **Create strictly from supplied documents:** `materials_only`; retain and upload every selected source.
SKILL.md
153
- **Create with source-assisted research:** `open` with the supplied documents as anchors.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill runs bundled bootstrap installers that download and install remote executables at runtime from https://releases.personwise.ai/cli/v1.1.6/personwise_1.1.6_windows_amd64.zip (and the corresponding platform artifact URL https://releases.personwise.ai/cli/v1.1.6/$artifact), which fetches remote code the skill relies on and would be executed—constituting a runtime external dependency that controls execution.
Where we found it
personwise CLI 1.1.6 from https://releases.personwise.ai/cli/v1.1.6/
dependency · 7 sites
The skill bundles bootstrap.sh which downloads and installs the PersonWise CLI executable from https://releases.personwise.ai/cli/v1.1.6/ at runtime, fetching remote code that controls execution.
- Audited
- Security analysis