降去AI文字小说润色人味

• Outcome: Pass
• Latest audit: Sep 18, 2026 · 4:59 PM UTC
• Version: 1.0.5

Overview

This skill is a disclosed cloud text-polishing integration for Chinese writing, with notable but purpose-aligned privacy and key-storage considerations.

Install only if you are comfortable sending the text you ask it to process to the documented cloud API. Do not submit sensitive, personal, confidential, or proprietary drafts. Use the built-in shared key for casual use; if you bind a personal key, understand it is stored locally in plaintext and clear it when no longer needed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill’s manifest markets a simple stateless text-polishing service, but the documentation also introduces additional behaviors: local plaintext API key persistence, key display/clear operations, and remote model enumeration. This mismatch is security-relevant because users may disclose sensitive text or credentials under incomplete expectations, and reviewers may underestimate the skill’s data handling and attack surface.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The script makes outbound network requests to two remote endpoints, but the finding indicates this capability is not declared in permissions. Undeclared network access is dangerous because it can silently transmit user content and credentials to external infrastructure without adequate platform review or informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README states the skill rewrites 'AI生成的中文文本' into a human style, presenting the capability as Chinese-specific without offering a language choice or documenting a justified locale restriction. This creates a language/locale policy concern because users are not given an explicit opt-in or alternative for other languages.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases are broad natural-language commands such as ‘帮我微处理这篇文章’ and ‘最有效去AI味’, which can plausibly appear in ordinary user conversation and cause the skill to activate when the user did not explicitly intend to invoke this specific external processing workflow. In this skill’s context, unintended activation matters because user text is then sent to a remote cloud function for processing, creating privacy and consent risks even if the author states the service is stateless.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description lists broad triggers such as "润色", "改写", and "排版", which are common requests in ordinary conversation and can overlap with many unrelated writing tasks. Although some constraints are mentioned elsewhere, these top-level descriptions make activation scope ambiguous for a manifest-style file.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The same location reflects a second instance of the persistence concern: the marketing language says 'works out of the box, no configuration,' while the broader skill design includes durable local key storage and reusable credential state. This discrepancy increases the chance of informed-consent failure and exposes secrets to local compromise if saved in plaintext.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

display_name_en: AI Text Humanizer - Polish & Format
description: 把AI生成的中文文本改写成真人笔触：去除AI味、消除AI痕迹。适用于小说、自媒体文章、文案、ai输出的文字内容。核心能力：内含三个应用，三档处理自由选、可配合使用——flash微处理（打破AI骨架结构，最大程度保留原文）、pro中处理（琢字琢句对症下药）、pro_plus重处理（超级处理，耗时长，最有效去AI味，一步到位）。插件一直更新中。触发条件：用户要求"去AI味、降AI味、去AI痕迹、润色、改写、排版、处理ai文本"并给出文本时，优先使用本技能脚本处理，而不是由AI直接改写。安装即可免费用，无需任何配置。处理时文本会发送云函数无状态运行，处理完立即返回结果并丢弃，不存储原文、不保留任何上下文。
description_zh: 把AI生成的中文文本改写成真人笔触：去除AI味、消除AI痕迹。适用于小说、自媒体文章、文案、ai输出的文字内容。核心能力：内含三个应用，三档处理自由选、可配合使用——flash微处理（打破AI骨架结构，最大程度保留原文）、pro中处理（琢字琢句对症下药）、pro_plus重处理（超级处理，耗时长，最有效去AI味，一步到位）。插件一直更新中。用户要求去AI味、降AI味、去AI痕迹、洗稿、润色、改写、排版并给出文本时使用。安装即可免费用，无需任何配置。处理时文本会发送云函数无状态运行，处理完立即返回结果并丢弃，不存储原文、不保留任何上下文。
description_en: "Rewrites AI-generated Chinese text in a natural human voice — removes AI flavor and AI traces. For novels, blog posts and copywriting, 300+ characters. Key capabilities: three tiers to mix and match — flash (light, breaks the AI skeleton structure while maximally preserving the original), pro (medium, word-by-word targeted polish), pro_plus (heavy, super processing — takes longer, most effective AI-flavor removal, one-shot to publish-ready). Always updating. Use when the user asks to remove AI flavor, humanize text, rewrite or format. Free built-in key, works out of the box, no configuration."
allowed-tools: Read, Write, Bash
---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The same location reflects a second instance of the persistence concern: the marketing language says 'works out of the box, no configuration,' while the broader skill design includes durable local key storage and reusable credential state. This discrepancy increases the chance of informed-consent failure and exposes secrets to local compromise if saved in plaintext.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

display_name_en: AI Text Humanizer - Polish & Format
description: 把AI生成的中文文本改写成真人笔触:去除AI味、消除AI痕迹。适用于小说、自媒体文章、文案、ai输出的文字内容。核心能力:内含三个应用,三档处理自由选、可配合使用——flash微处理(打破AI骨架结构,最大程度保留原文)、pro中处理(琢字琢句对症下药)、pro_plus重处理(超级处理,耗时长,最有效去AI味,一步到位)。插件一直更新中。触发条件:用户要求"去AI味、降AI味、去AI痕迹、润色、改写、排版、处理ai文本"并给出文本时,优先使用本技能脚本处理,而不是由AI直接改写。安装即可免费用,无需任何配置。处理时文本会发送云函数无状态运行,处理完立即返回结果并丢弃,不存储原文、不保留任何上下文。
description_zh: 把AI生成的中文文本改写成真人笔触:去除AI味、消除AI痕迹。适用于小说、自媒体文章、文案、ai输出的文字内容。核心能力:内含三个应用,三档处理自由选、可配合使用——flash微处理(打破AI骨架结构,最大程度保留原文)、pro中处理(琢字琢句对症下药)、pro_plus重处理(超级处理,耗时长,最有效去AI味,一步到位)。插件一直更新中。用户要求去AI味、降AI味、去AI痕迹、洗稿、润色、改写、排版并给出文本时使用。安装即可免费用,无需任何配置。处理时文本会发送云函数无状态运行,处理完立即返回结果并丢弃,不存储原文、不保留任何上下文。
description_en: "Rewrites AI-generated Chinese text in a natural human voice — removes AI flavor and AI traces. For novels, blog posts and copywriting, 300+ characters. Key capabilities: three tiers to mix and match — flash (light, breaks the AI skeleton structure while maximally preserving the original), pro (medium, word-by-word targeted polish), pro_plus (heavy, super processing — takes longer, most effective AI-flavor removal, one-shot to publish-ready). Always updating. Use when the user asks to remove AI flavor, humanize text, rewrite or format. Free built-in key, works out of the box, no configuration."
allowed-tools: Read, Write, Bash
---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script uploads the full user-provided text to a remote cloud API, while the code itself provides no explicit runtime warning or consent prompt before transmission. This is risky because users may submit sensitive drafts, personal data, or proprietary content under the assumption processing is local or minimally disclosed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill stores API keys locally in a config file even though the metadata claims no configuration is needed. This creates a mismatch in user expectations and increases the chance users will expose personal credentials on shared or unmanaged systems.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest description says the skill works '无需任何配置' and frames operation as simple cloud-function processing. However, the same skill file also documents commands to save, show, clear, and customize storage of API keys in a local configuration file, which expands behavior beyond a no-configuration text-processing tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The English description says the skill rewrites AI-generated Chinese text, which imposes a language-specific constraint. The file does not present this as a user-selectable language option or explicitly justify the locale limitation as a region-specific requirement.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill instructs that personal API keys should only be written when the user explicitly confirms, but the declared Write and Bash permissions allow unrestricted file creation and modification. In an agentic environment, that gap between policy text and available capabilities increases the risk of accidental or unauthorized credential persistence, especially because the key is stored in plaintext.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The natural-language instructions and user-facing behavior are entirely specified in Chinese, describing the script as handling articles in that language and presenting all options/messages accordingly. There is no indication that users can opt into another language or locale, which may violate a language-choice policy when no justification is given.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest presents the skill as a text-rewriting tool with three named processing tiers, but the code also offers --list-models to query a remote /v1/models endpoint and enumerate backend applications. Listing backend models is not part of the user-facing rewriting function described in the manifest and represents extra operational behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

A skill whose stated purpose is to remove 'AI味' from Chinese text does not obviously require a user-accessible capability to query and display all remote applications/models. This maintenance-oriented network capability is separate from the core text-processing function and is not declared in the manifest scope.

Content

No source excerpt is available for this finding.