المهارات personwise-security-awareness-training

📦

personwise-security-awareness-training

Name: personwise-security-awareness-training
Author: personwiseai

مراجعة المحتوى r1 مخاطر عالية 🌐 الوصول إلى الشبكة⚙️ الأوامر الخارجية📁 الوصول إلى نظام الملفات

Build Security Awareness Training

Security policies are difficult to convert into clear employee training. This skill creates a grounded, interactive PersonWise course from supplied materials.

يدعم: Claude Codex Code(CC)

⚠️ 38 ضعيف

توقف واطلب التأكيد قبل التثبيت.

راجع الخطة واحصل على موافقة صريحة من المستخدم قبل تغيير الملفات.

التثبيت باستخدام Agent لدي

انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.

طلب الوكيل

Review the Skillstore skill "personwise-security-awareness-training" from https://skillstore.io/skills/personwiseai-personwise-security-awareness-training.md and its manifest at https://skillstore.io/api/skills/personwiseai-personwise-security-awareness-training/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.

موارد مهيّأة لـ Agents

استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.

تفاصيل Markdown GET /skills/personwiseai-personwise-security-awareness-training.md manifest موقَّع GET /api/skills/personwiseai-personwise-security-awareness-training/manifest lockfile موقَّع GET /api/skills/personwiseai-personwise-security-awareness-training/lockfile

اختبرها

جارٍ استخدام "personwise-security-awareness-training". Create a five-page private course from our phishing and incident-reporting policies.

النتيجة المتوقعة:

Resolved length: five pages.
Sources: phishing policy ready; incident-reporting policy ready.
Review: outline and script passed grounded-content checks.
Access: private and login required.
Delivery: editor link returned after playability verification.

جارٍ استخدام "personwise-security-awareness-training". Turn our remote-work security guide into awareness training for contractors.

النتيجة المتوقعة:

Created a contractor-focused course covering device care, suspicious messages, approved access, and the documented reporting path. The course remains private.

جارٍ استخدام "personwise-security-awareness-training". Publish the reviewed course for anyone with the link and report its final status.

النتيجة المتوقعة:

The course completed successfully, link access is enabled, and the returned share link is ready for distribution.

التدقيق الأمني

مخاطر عالية

v1 • ٥‏/٨‏/٢٠٢٦ فتح التقرير المرتبط بالإصدار

Two static network findings are confirmed because the bootstrap installs opaque vendor executables that this audit cannot inspect. The remaining 140 static matches are false positives involving Markdown formatting, defensive installer operations, or signed descriptor data. Semantic review also found unvalidated service-supplied command execution and sensitive-document upload risks.

الملفات التي تم فحصها

648

الأسطر التي تم تحليلها

عناصر المراجعة

تم تجاهل الإيجابيات الكاذبة

مخاوف أمنية مؤكدة (2)

مرتفع

SKILL.md:107-115

Unvalidated Service-Supplied Command Execution

The skill tells the agent to run the exact update action returned by the PersonWise service after approval. Without an argv allowlist, a compromised response could supply an arbitrary shell command.

The instruction to execute the returned action exactly is explicit, while no command grammar or metacharacter rejection is defined.

متوسط

SKILL.md:197-205

External Upload of Potentially Sensitive Policies

The workflow uploads every user-selected source document to PersonWise. Security policies and incident procedures can contain sensitive internal information, so this creates a material data-egress boundary.

The source-add workflow and upload language directly confirm remote transmission; user selection limits scope but does not remove confidentiality risk.

عناصر مراجعة القدرات (2)

هذه قدرات محلية حقيقية قد يُتوقع وجودها لهذه المهارة، لذا فهي تتطلب مراجعة ولكن لا تُحتسب كسلوك خبيث مؤكد.

مرتفع

assets/bootstrap.ps1:43

Hardcoded URL

$request = [Net.Http.HttpRequestMessage]::new([Net.Http.HttpMethod]::Get, "https://releases.personwi

The installer downloads and installs an unaudited executable from the author's server. TLS, fixed size, and a pinned hash verify delivery but not binary safety.

مرتفع

assets/bootstrap.sh:132

Hardcoded URL

url="https://releases.personwise.ai/cli/v1.1.6/$artifact"

The installer downloads and installs an unaudited executable from the author's server. Restricted TLS and pinned hashes protect integrity but do not establish benign behavior.

عوامل الخطر

🌐 الوصول إلى الشبكة (2)

assets/bootstrap.ps1:43 assets/bootstrap.sh:132

⚙️ الأوامر الخارجية (50)

📁 الوصول إلى نظام الملفات (7)

assets/bootstrap.sh:81 assets/bootstrap.sh:83 assets/bootstrap.sh:128 assets/bootstrap.sh:16 assets/bootstrap.sh:18 assets/bootstrap.sh:128 assets/bootstrap.sh:180

دقّقه: codex

شارك واستشهد بهذا التقرير

شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.

فتح التقرير المرتبط بالإصدار

نسخ رابط التقرير

https://skillstore.io/skills/personwiseai-personwise-security-awareness-training/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

شارة Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/personwiseai-personwise-security-awareness-training/security.svg)](https://skillstore.io/skills/personwiseai-personwise-security-awareness-training?utm_source=security_passport_badge)

شارة HTML

<a href="https://skillstore.io/skills/personwiseai-personwise-security-awareness-training?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/personwiseai-personwise-security-awareness-training/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

بطاقة قابلة للتضمين

<iframe src="https://skillstore.io/embed/skills/personwiseai-personwise-security-awareness-training.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

الاستشهادات الأكاديمية (APA · BibTeX · CFF)

اقتباس APA

personwiseai. (2026). personwise-security-awareness-training security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/personwiseai-personwise-security-awareness-training/audits/1

اقتباس BibTeX

@techreport{personwiseai-personwiseai-personwise-security-awareness-training-2026,
  author = {personwiseai},
  title = {personwise-security-awareness-training security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/personwiseai-personwise-security-awareness-training/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "personwise-security-awareness-training security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "personwiseai"
date-released: "2026-08-05"
url: "https://skillstore.io/skills/personwiseai-personwise-security-awareness-training/audits/1"
identifiers:
  - type: other
    value: "skillstore:personwiseai-personwise-security-awareness-training:audit:1"
    description: "Skillstore immutable audit report identifier"

تقييم Skillstore

سبب هذا التقييم موثوقية الأدلة: متوسط

الهندسة المعمارية

قابلية الصيانة

المحتوى

المجتمع

الامتثال للمواصفات

ما الذي يمكنك بناؤه

Train New Employees

Convert approved security policies into a concise private course covering recognition, response, and reporting.

Refresh Department Guidance

Create role-specific awareness training from current procedures for teams facing distinct security risks.

Publish Compliance Support

Prepare a reviewed awareness course for controlled internal sharing without claiming external certification.

جرّب هذه الموجّهات

Create a Basic Course

Build a private security awareness course from [policy file] for [audience]. Focus on recognizing threats and using the documented reporting channel.

Set Course Scope

Create a [page count]-page security awareness course from [materials]. Cover [topics], use [language], and keep every factual claim grounded.

Use Materials Only

Create a materials-only course from [documents] for [audience]. Include recognition, response, reporting, and a short understanding check.

Review and Publish

Resume course [project identifier], verify every source and checkpoint, correct unsupported content, then publish with [private or link] access.

أفضل الممارسات

Provide current, approved policies and identify the intended learner audience.
Specify the desired access mode, page count, language, and required reporting channel.
Review sensitive documents before authorizing their upload to PersonWise.

تجنب

Do not request invented breach stories, threat statistics, policies, or reporting procedures.
Do not present course completion as security certification or proof of practical competence.
Do not upload unrelated files, secrets, credentials, or documents without clear authorization.