降去AI痕迹润色人味1.6

• Outcome: Review
• Latest audit: Sep 18, 2026 · 3:58 PM UTC
• Version: 1.6.0

Overview

This skill performs its advertised text-humanizing function, but it sends full user text to a hard-coded cloud API and can store personal API keys in plaintext, with triggers broad enough to surprise users.

Install only if you are comfortable sending the text you ask it to process to the listed cloud service. Avoid private, regulated, or proprietary drafts, and do not save a personal API key unless plaintext local storage on that machine is acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill’s manifest and prose emphasize 'no configuration', ephemeral cloud processing, and no retention of submitted text, but the same document also introduces undisclosed security-relevant behavior: use of a built-in shared API key, optional local persistence of user API keys, and model-enumeration capability. This mismatch is dangerous because it can mislead users about how credentials and requests are handled, reducing informed consent and increasing the chance that sensitive content or credentials are provided under false assumptions.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The script performs outbound network requests to hard-coded remote endpoints, but the finding indicates this capability is not declared in permissions. Undeclared network access is security-relevant because it allows user text and credentials to leave the local environment without transparent permissioning or policy review, undermining user consent and platform controls.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states the skill rewrites 'AI生成的中文文本' into a more human style, presenting the capability as Chinese-specific without offering a language choice or documenting a justified regional constraint. This is a natural-language locale limitation that can violate language-choice policy when not framed as opt-in or region-specific.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger examples are broad enough to match common editing requests such as ‘润色’, ‘改写’, or ‘排版’, causing the skill to activate in ordinary conversations even when the user did not explicitly intend to invoke this external processing workflow. In this skill’s context, that matters because activation routes user text to a cloud function, increasing the chance of unintended data disclosure and surprising tool use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are broad and overlap with ordinary editing requests such as '润色', '改写', and '排版', and the skill explicitly tells the agent to prefer sending user text to the external script instead of handling it directly. In context, this increases the chance that user-provided content—including potentially sensitive drafts, personal writing, or proprietary text—is transmitted to a third-party cloud service when the user may only have wanted local or in-model assistance.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 74% confidence

Finding

This finding reflects the same persistence concern in duplicated manifest text: the skill’s 'no configuration/no retention' framing is undermined by instructions that can retain secrets locally and by workflow steps that create local temporary copies of user text. In a text-humanization skill, that context makes the issue more significant because users may submit drafts containing unpublished, private, or commercially sensitive material.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

display_name_en: AI Text Humanizer - Polish & Format
description: 把AI生成的中文文本改写成真人笔触：去除AI味、消除AI痕迹。适用于小说、自媒体文章、文案、ai输出的文字内容。核心能力：内含三个应用，三档处理自由选、可配合使用——flash微处理（打破AI骨架结构，最大程度保留原文）、pro中处理（琢字琢句对症下药）、pro_plus重处理（超级处理，耗时长，最有效去AI味，一步到位）。插件一直更新中。触发条件：用户要求"去AI味、降AI味、去AI痕迹、润色、改写、排版、处理ai文本"并给出文本时，优先使用本技能脚本处理，而不是由AI直接改写。安装即可免费用，无需任何配置。处理时文本会发送云函数无状态运行，处理完立即返回结果并丢弃，不存储原文、不保留任何上下文。
description_zh: 把AI生成的中文文本改写成真人笔触：去除AI味、消除AI痕迹。适用于小说、自媒体文章、文案、ai输出的文字内容。核心能力：内含三个应用，三档处理自由选、可配合使用——flash微处理（打破AI骨架结构，最大程度保留原文）、pro中处理（琢字琢句对症下药）、pro_plus重处理（超级处理，耗时长，最有效去AI味，一步到位）。插件一直更新中。用户要求去AI味、降AI味、去AI痕迹、洗稿、润色、改写、排版并给出文本时使用。安装即可免费用，无需任何配置。处理时文本会发送云函数无状态运行，处理完立即返回结果并丢弃，不存储原文、不保留任何上下文。
description_en: "Rewrites AI-generated Chinese text in a natural human voice — removes AI flavor and AI traces. For novels, blog posts and copywriting, 300+ characters. Key capabilities: three tiers to mix and match — flash (light, breaks the AI skeleton structure while maximally preserving the original), pro (medium, word-by-word targeted polish), pro_plus (heavy, super processing — takes longer, most effective AI-flavor removal, one-shot to publish-ready). Always updating. Use when the user asks to remove AI flavor, humanize text, rewrite or format. Free built-in key, works out of the box, no configuration."
allowed-tools: Read, Write, Bash
---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 74% confidence

Finding

This finding reflects the same persistence concern in duplicated manifest text: the skill’s 'no configuration/no retention' framing is undermined by instructions that can retain secrets locally and by workflow steps that create local temporary copies of user text. In a text-humanization skill, that context makes the issue more significant because users may submit drafts containing unpublished, private, or commercially sensitive material.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

display_name_en: AI Text Humanizer - Polish & Format
description: 把AI生成的中文文本改写成真人笔触:去除AI味、消除AI痕迹。适用于小说、自媒体文章、文案、ai输出的文字内容。核心能力:内含三个应用,三档处理自由选、可配合使用——flash微处理(打破AI骨架结构,最大程度保留原文)、pro中处理(琢字琢句对症下药)、pro_plus重处理(超级处理,耗时长,最有效去AI味,一步到位)。插件一直更新中。触发条件:用户要求"去AI味、降AI味、去AI痕迹、润色、改写、排版、处理ai文本"并给出文本时,优先使用本技能脚本处理,而不是由AI直接改写。安装即可免费用,无需任何配置。处理时文本会发送云函数无状态运行,处理完立即返回结果并丢弃,不存储原文、不保留任何上下文。
description_zh: 把AI生成的中文文本改写成真人笔触:去除AI味、消除AI痕迹。适用于小说、自媒体文章、文案、ai输出的文字内容。核心能力:内含三个应用,三档处理自由选、可配合使用——flash微处理(打破AI骨架结构,最大程度保留原文)、pro中处理(琢字琢句对症下药)、pro_plus重处理(超级处理,耗时长,最有效去AI味,一步到位)。插件一直更新中。用户要求去AI味、降AI味、去AI痕迹、洗稿、润色、改写、排版并给出文本时使用。安装即可免费用,无需任何配置。处理时文本会发送云函数无状态运行,处理完立即返回结果并丢弃,不存储原文、不保留任何上下文。
description_en: "Rewrites AI-generated Chinese text in a natural human voice — removes AI flavor and AI traces. For novels, blog posts and copywriting, 300+ characters. Key capabilities: three tiers to mix and match — flash (light, breaks the AI skeleton structure while maximally preserving the original), pro (medium, word-by-word targeted polish), pro_plus (heavy, super processing — takes longer, most effective AI-flavor removal, one-shot to publish-ready). Always updating. Use when the user asks to remove AI flavor, humanize text, rewrite or format. Free built-in key, works out of the box, no configuration."
allowed-tools: Read, Write, Bash
---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The English guidance is similarly overbroad, covering generic requests like 'rewrite or format'. Because this skill transmits content to a cloud function and discourages direct AI editing, broad matching can cause unnecessary third-party disclosure of user text without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation instructs that user API keys may be saved in plaintext in a local config file. Plaintext credential storage is a direct secret-handling weakness: any other local user, malware, backups, shell history, or misconfigured file permissions could expose the key and enable unauthorized use of the user’s account or quota.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This section adds a local credential-management workflow, including saving, displaying, and clearing personal API keys via CLI flags. Those capabilities are not part of the manifest's core promise of rewriting Chinese text and are not obviously required for the user-facing purpose, especially since the manifest emphasizes out-of-box use with no configuration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language instructions and behavior are presented exclusively in Chinese, including user-facing descriptions of modes and expected usage, with no indication of language choice or opt-in. Under the policy, forcing a specific language without user choice can be a locale/language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The core function sends the full user-provided text to a third-party cloud function, but there is no execution-time warning or consent check in the script itself. This is dangerous because users may submit sensitive drafts, personal data, or proprietary content under the assumption of local processing, causing unintended data exfiltration to an external service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script supports saving a user API key locally in a persistent config file, which conflicts with the description that installation requires no configuration. While the file permissions attempt to limit access, storing secrets on disk increases exposure to local compromise, backup leakage, or accidental disclosure, especially when users may not expect persistence.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest states '无需任何配置' and presents the skill as install-and-use, but the file later documents configurable key storage paths and commands for saving personal keys. Although optional, this broadens the actual operational behavior beyond the simple no-configuration framing in the description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest presents the skill as offering three built-in applications/modes, but the code can query the remote '/v1/models' endpoint to retrieve an arbitrary current application list from the backend. That behavior expands the effective feature surface beyond the fixed three-mode description.

Content

No source excerpt is available for this finding.