Skills personwise-customer-onboarding

📦

personwise-customer-onboarding

Name: personwise-customer-onboarding
Author: personwiseai

Content revision r1 High Risk 🌐 Network access⚙️ External commands📁 Filesystem access

Build Interactive Customer Onboarding Courses

Customer onboarding materials often remain fragmented and difficult to teach consistently. This skill turns confirmed sources into a reviewed, interactive PersonWise course.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "personwise-customer-onboarding" from https://skillstore.io/skills/personwiseai-personwise-customer-onboarding.md and its manifest at https://skillstore.io/api/skills/personwiseai-personwise-customer-onboarding/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/personwiseai-personwise-customer-onboarding.md Signed manifest GET /api/skills/personwiseai-personwise-customer-onboarding/manifest Signed lockfile GET /api/skills/personwiseai-personwise-customer-onboarding/lockfile

Test it

Using "personwise-customer-onboarding". Create a private onboarding course from our implementation guide for new administrators.

Expected outcome:

Resolved course: five pages for new administrators.
Sources: implementation guide processed successfully.
Review: outline, script, and media checks completed.
Access: private and sign-in required.

Using "personwise-customer-onboarding". Update our onboarding course because the support process changed.

Expected outcome:

The support and escalation sections were updated from the supplied policy. Unrelated slides and the existing access mode were preserved.

Using "personwise-customer-onboarding". Publish the approved customer onboarding course for anyone with the link.

Expected outcome:

Link access was enabled after a fresh course check. The returned share link is playable by anyone who receives it.

Security Audit

High Risk

v1 • 8/5/2026 Open versioned report

Most static findings are false positives from guarded installer checks, Markdown backticks, and signed descriptor data. Confirmed risks include executable installation, response-supplied update commands, unsigned releases, external document uploads, and credit consumption without separate confirmation.

Files scanned

644

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

SKILL.md:68-74 assets/bootstrap.sh:54-56 assets/bootstrap.sh:65-67 assets/bootstrap.ps1:10-12

Unsigned CLI installation with muted trust disclosure

The skill discourages signing disclosure during installation. Both installers accept releases without verified native platform signatures and rely on embedded hashes.

The instructions suppress trust narration, while both scripts explicitly mark native signatures as not required or not verified.

Medium

SKILL.md:134-145 SKILL.md:193-201

Third-party upload of customer source materials

The skill treats user selection as upload authorization and sends selected sources to PersonWise. Sensitive onboarding documents can leave the local environment.

The workflow explicitly requires source add for selected documents and describes upload grants, proving transfer to the external PersonWise service.

Medium

SKILL.md:128-132 SKILL.md:176-177

Course credits consumed without separate confirmation

The skill treats a course request as authorization to consume existing credits and forbids confirmation. This can spend account resources without transaction-specific consent.

The authorization rule explicitly permits existing-credit consumption and says not to ask again before consuming a credit.

Capability review items (6)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:105-106

Ruby/shell backtick execution

`action` command. The task cannot continue until that update is installed. Ask for approval;

The agent is told to execute an action command supplied by a CLI response. Remote-provided command text creates a command and supply-chain risk.

High

SKILL.md:106-109

Ruby/shell backtick execution

with approval, run exactly that command (it already carries the required `--approve-upgrade`

This line explicitly directs execution of the returned action after approval. Approval limits autonomy but does not validate the command structure.

Medium

SKILL.md:69-70

Ruby/shell backtick execution

2. If missing or too old, run the bundled `assets/bootstrap.sh --approve-install` on Linux/macOS

This line directs the agent to run the bundled shell installer when the CLI is missing. It causes external binary installation after approval.

Medium

SKILL.md:70-75

Ruby/shell backtick execution

or `assets/bootstrap.ps1 --approve-install` on Windows. Let the Host obtain any installation

This line continues the instruction to run the bundled PowerShell installer on Windows. It causes external binary installation after host approval.

Medium

SKILL.md:121-122

Ruby/shell backtick execution

instead (`assets/bootstrap.sh --approve-upgrade` on Linux/macOS,

This line directs the agent to run the bundled shell bootstrap for an upgrade. The command downloads and replaces an executable after approval.

Medium

SKILL.md:122

Ruby/shell backtick execution

`assets/bootstrap.ps1 --approve-upgrade` on Windows; use `--approve-install` when no recognized

This line directs the Windows bootstrap or installation path. It performs executable installation or replacement after approval.

Risk Factors

🌐 Network access (2)

assets/bootstrap.ps1:43 assets/bootstrap.sh:132

⚙️ External commands (50)

📁 Filesystem access (7)

assets/bootstrap.sh:81 assets/bootstrap.sh:83 assets/bootstrap.sh:128 assets/bootstrap.sh:16 assets/bootstrap.sh:18 assets/bootstrap.sh:128 assets/bootstrap.sh:180

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/personwiseai-personwise-customer-onboarding/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/personwiseai-personwise-customer-onboarding/security.svg)](https://skillstore.io/skills/personwiseai-personwise-customer-onboarding?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/personwiseai-personwise-customer-onboarding?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/personwiseai-personwise-customer-onboarding/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/personwiseai-personwise-customer-onboarding.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

personwiseai. (2026). personwise-customer-onboarding security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/personwiseai-personwise-customer-onboarding/audits/1

BibTeX citation

@techreport{personwiseai-personwiseai-personwise-customer-onboarding-2026,
  author = {personwiseai},
  title = {personwise-customer-onboarding security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/personwiseai-personwise-customer-onboarding/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "personwise-customer-onboarding security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "personwiseai"
date-released: "2026-08-05"
url: "https://skillstore.io/skills/personwiseai-personwise-customer-onboarding/audits/1"
identifiers:
  - type: other
    value: "skillstore:personwiseai-personwise-customer-onboarding:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Standardize New Customer Training

Convert approved onboarding guides into one consistent course that explains milestones, first value, support, and escalation.

Launch Client Implementation Education

Build a grounded course from implementation documents while preserving confirmed scope, responsibilities, timelines, and support channels.

Maintain Product Onboarding Content

Review an existing course, update supported fields, inspect generated media, and republish only after fresh state checks.

Try These Prompts

Create a Basic Onboarding Course

Create a private customer onboarding course from the attached guide. Focus on first value, responsibilities, next steps, and support channels.

Create a Materials-Only Course

Build a six-page customer onboarding course using only the selected documents. Flag missing commitments instead of adding assumptions.

Refine an Existing Course

Review the current course snapshot. Preserve slide order and revise unsupported claims, repeated points, unclear actions, and inconsistent support guidance.

Run an Advanced Published Workflow

Create two onboarding courses for different customer tiers. Recheck readiness before each course, review every checkpoint, then enable link access.

Best Practices

Provide current, approved onboarding materials and identify the intended learner.
State the desired page count and access mode before course creation.
Review source status, factual claims, and playability before sharing the final URL.

Avoid

Do not include secrets, regulated data, or unrelated customer records in uploaded sources.
Do not ask the skill to invent timelines, service levels, pricing, or contractual commitments.
Do not treat a private editor URL as a public share link.