技能 personwise-interactive-product-explainer

📦

personwise-interactive-product-explainer

Name: personwise-interactive-product-explainer
Author: personwiseai

内容修订 r1 高风险 🌐 网络访问⚙️ 外部命令📁 文件系统访问

Build a Source-Grounded Interactive Product Explainer

Product teams need clear explainers without unsupported claims or invented interfaces. This skill creates an askable PersonWise experience from verified product materials.

支持: Claude Codex Code(CC)

⚠️ 38 差

安装前请停下并请求确认。

请审查安装计划，并在更改文件前获得用户明确同意。

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "personwise-interactive-product-explainer" from https://skillstore.io/skills/personwiseai-personwise-interactive-product-explainer.md and its manifest at https://skillstore.io/api/skills/personwiseai-personwise-interactive-product-explainer/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/personwiseai-personwise-interactive-product-explainer.md 已签名 manifest GET /api/skills/personwiseai-personwise-interactive-product-explainer/manifest 已签名 lockfile GET /api/skills/personwiseai-personwise-interactive-product-explainer/lockfile

测试它

正在使用“personwise-interactive-product-explainer”。 Create a private explainer from our verified launch brief and current pricing page.

预期结果:

Teaching arc: audience problem, product promise, verified workflow, value and limits, approved next step.
Source boundary: launch brief and current pricing page only.
Access: private editor link, available after login.

正在使用“personwise-interactive-product-explainer”。 Build an embeddable product explainer using our documentation and supplied screenshots.

预期结果:

Claims were checked against the documentation, with unsupported statements removed or qualified.
Supplied screenshots were retained as exact references, and generated slides passed visual review.
Access: link-enabled and ready for the requested embed workflow.

正在使用“personwise-interactive-product-explainer”。 Explain our product, but the security and integration details are not documented.

预期结果:

The explainer omits security and integration claims and lists both topics as open questions for the product owner.

安全审计

高风险

v1 • 2026/8/5 打开版本化报告

Two static network findings are confirmed because the installers download executable archives, although pinned sizes and hashes reduce tampering risk. The other static findings are safe shell, filesystem, Markdown, or signed-data patterns. Semantic review found remote-provided update command execution, missing native signature enforcement, and external source uploads.

已扫描文件

676

分析行数

复核项

已忽略误报

已确认安全问题 (3)

高

references/workflow.md:35-43 references/workflow.md:46-50

Remote-Provided Update Command Execution

The workflow tells the agent to execute an action command returned by the PersonWise service after approval. It does not require strict parsing or argument allowlisting.

The instructions explicitly say to run the exact returned action. User approval and the fixed service reduce exposure, but they do not validate command structure.

中

assets/bootstrap.sh:54-68 assets/bootstrap.ps1:10-12 assets/bootstrap.ps1:85-88

Native Binary Signature Verification Disabled

The installers label macOS and Windows signatures as deferred and do not require native publisher verification. Embedded hashes protect downloads but do not independently establish publisher identity.

Both installers explicitly disable required native signature checks for distributed binaries. The remaining pinned hashes are visible but are controlled by the same skill package.

中

references/workflow.md:105-111 references/product-grounding.md:31-36

External Upload of Product Materials

The workflow uploads selected product documents and images to PersonWise without a separate upload confirmation. Confidential product materials could leave the local environment.

The instructions directly require uploads to the authenticated PersonWise service. Files are user-selected, but the workflow explicitly says no extra approval is needed.

能力复核项 (2)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

低

assets/bootstrap.ps1:43

Hardcoded URL

$request = [Net.Http.HttpRequestMessage]::new([Net.Http.HttpMethod]::Get, "https://releases.personwi

The PowerShell installer downloads an executable archive from the fixed PersonWise release host. Size and SHA-256 checks reduce tampering risk, but the external binary download is real.

低

assets/bootstrap.sh:132

Hardcoded URL

url="https://releases.personwise.ai/cli/v1.1.6/$artifact"

The shell installer downloads a platform executable archive from the fixed PersonWise release host. TLS, size, archive-entry, and checksum checks mitigate but do not remove the network dependency.

风险因素

🌐 网络访问 (2)

assets/bootstrap.ps1:43 assets/bootstrap.sh:132

⚙️ 外部命令 (28)

📁 文件系统访问 (7)

assets/bootstrap.sh:81 assets/bootstrap.sh:83 assets/bootstrap.sh:128 assets/bootstrap.sh:16 assets/bootstrap.sh:18 assets/bootstrap.sh:128 assets/bootstrap.sh:180

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/personwiseai-personwise-interactive-product-explainer/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/personwiseai-personwise-interactive-product-explainer/security.svg)](https://skillstore.io/skills/personwiseai-personwise-interactive-product-explainer?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/personwiseai-personwise-interactive-product-explainer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/personwiseai-personwise-interactive-product-explainer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/personwiseai-personwise-interactive-product-explainer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

personwiseai. (2026). personwise-interactive-product-explainer security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/personwiseai-personwise-interactive-product-explainer/audits/1

BibTeX 引用

@techreport{personwiseai-personwiseai-personwise-interactive-product-explainer-2026,
  author = {personwiseai},
  title = {personwise-interactive-product-explainer security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/personwiseai-personwise-interactive-product-explainer/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "personwise-interactive-product-explainer security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "personwiseai"
date-released: "2026-08-05"
url: "https://skillstore.io/skills/personwiseai-personwise-interactive-product-explainer/audits/1"
identifiers:
  - type: other
    value: "skillstore:personwiseai-personwise-interactive-product-explainer:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Prepare a Launch Explainer

Turn verified launch materials into a concise, askable product introduction for a launch page.

Replace a Static Product Demo

Create an interactive product walkthrough that explains documented workflows without inventing interface details.

Build a Sales Follow-Up

Create a grounded explainer that summarizes fit, use cases, proof, limitations, and the approved next step.

试试这些提示

Create a Basic Product Explainer

Create a private interactive explainer for [product]. Use only the attached product brief and identify any missing evidence.

Build a Launch Page Companion

Create an askable explainer for [launch]. Ground every claim in these documents and use [URL] as the approved next step.

Create a Strictly Grounded Walkthrough

Create a [slide count]-page explainer from the selected files. Preserve documented limitations and exclude unsupported pricing, security, integration, and performance claims.

Publish an Embedded Product Story

Create and review an embedded explainer for [audience]. Audit every sentence against the source ledger and regenerate all visually misleading slides before publishing.

最佳实践

Provide current first-party materials and clearly identify the authoritative source for each time-sensitive claim.
State the intended audience, next step, and access target before course creation.
Review confidential files before authorizing upload to PersonWise.

避免

Do not ask the skill to invent interface screens, customer proof, pricing, integrations, or performance results.
Do not use broad research when the explainer must stay within supplied documents.
Do not request public access when the source materials contain confidential information.