Humanize Ai Writing

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:41 AM UTC
• Version: 1.0.0

Overview

This writing cleanup skill is mostly purpose-aligned, but it can automatically edit paths from a review file and run validators in ways that create real local file and code-execution risk.

Install only if you trust the review file producer and are comfortable with automatic repository edits. Prefer dry-run first, review .beagle/ai-writing-review.json before applying fixes, avoid running it in untrusted repositories, and replace the unpinned npx/Python validation patterns with path-safe, pinned, worktree-contained validators before broad use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:203

Finding

Python Source Injection Through Unescaped File Paths

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 203
Vulnerability Type: Python source injection through unsafe string interpolation
Risk Level: High

Vulnerable Code

bash

python3 -c "import ast; ast.parse(open('$file').read())"

Technical Analysis

The validation command interpolates $file directly into Python source code inside a single-quoted string. The file path is derived from findings in .beagle/ai-writing-review.json, but the Skill does not escape the value or validate its format.

A path containing a single quote can terminate the argument to open() and append arbitrary Python statements. Shell quoting does not prevent this because the malicious content becomes part of the source passed to python3 -c.

Attack Path

1. An attacker commits or generates a poisoned .beagle/ai-writing-review.json.
2. A finding identifies a Python file using a path containing Python syntax, such as a quote followed by attacker-controlled statements.
3. The Skill processes the finding and assigns that path to $file.
4. During validation, $file is embedded directly in the python3 -c program.
5. The injected Python statements execute with the same operating-system privileges as the Agent.

Impact Assessment

Successful exploitation provides arbitrary local code execution under the Agent's account. The attacker could read or alter any files available to that account, access inherited environment variables and credentials, execute subprocesses, or tamper with the checked-out repository. The flaw does not itself elevate privileges beyond the Agent's operating-system account.

Remediation

View remediation

Remediation Suggestions

Pass the file path as a positional argument instead of embedding it in executable Python source:

bash

python3 -c \
  'import ast, pathlib, sys; ast.parse(pathlib.Path(sys.argv[1]).read_text())' \
  -- "$file"

In addition:

1. Validate every path before invoking a validator.
2. Resolve it to a canonical path and require it to remain under the Git worktree.
3. Reject null bytes, absolute paths, traversal components, and symlinks that resolve outside the worktree.
4. Validate the JSON report against a strict schema before processing it.
5. Use subprocess argument arrays rather than constructing executable source or shell command strings.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:141

Finding

Unrestricted Finding Paths Permit Writes Outside the Repository

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 141-156
Vulnerability Type: Arbitrary file modification through unvalidated paths
Risk Level: High

Vulnerable Code

text

Otherwise, apply fixes grouped by file to minimize file I/O:

1. Sort findings by file, then by line number (descending, to avoid offset drift)
2. For each file, apply all safe fixes in reverse line order
3. For git artifacts (`git:commit:*`, `git:pr:*`), skip — these can't be auto-fixed. Report them for manual attention.

text

Otherwise, for each fix, prompt interactively:

Technical Analysis

The Skill treats file names from .beagle/ai-writing-review.json as edit targets without requiring them to resolve inside the current repository. It does not reject absolute paths, .. traversal, or symbolic links that point outside the worktree.

Findings classified as safe are applied automatically, so interactive confirmation for other findings does not mitigate this issue. A malicious report can identify an arbitrary writable file as the target of a nominally safe edit.

Attack Path

1. An attacker places a crafted .beagle/ai-writing-review.json in the repository or influences the review process that creates it.
2. The report contains a safe finding whose file field is an absolute path, a traversal path such as ../../target, or a repository symlink that resolves externally.
3. The Skill partitions the finding into the automatically applied safe-fix group.
4. It opens and rewrites the supplied target without checking repository containment.
5. The external file is modified using the Agent's existing filesystem permissions.

Impact Assessment

An attacker could alter any file writable by the Agent, including user configuration, shell initialization files, source trees outside the project, or application configuration. Depending on which files the account can modify, subsequent processes may execute ...[truncated 203 chars]

Remediation

View remediation

Remediation Suggestions

Enforce a strict repository boundary before reading or modifying any target:

1. Determine the canonical worktree root with git rev-parse --show-toplevel.
2. Resolve each supplied target to a canonical absolute path.
3. Require the canonical target to be equal to or located beneath the canonical worktree root.
4. Reject absolute input paths, .. components, null bytes, and unsupported pseudo-paths before resolution.
5. Detect and reject symbolic links whose resolved destination is outside the worktree.
6. Require target files to be regular files.
7. Validate every report entry against an allowlisted schema.
8. Present the canonical relative target in any confirmation prompt.
9. Apply edits through an API that receives validated path objects rather than raw strings.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:211

Finding

Unpinned Remote Package Execution During JavaScript Validation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 211
Vulnerability Type: Mutable third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

npx -y acorn --ecma2020 "$file" > /dev/null 2>&1

Technical Analysis

The Skill invokes npx with automatic confirmation and no package version. If acorn is not already available through the expected local dependency tree, npx may retrieve and execute a package from the configured registry.

The effective executable can therefore change after the Skill has been audited. There is no exact version, lockfile requirement, integrity constraint, or verified local binary in the documented command. This creates a supply-chain execution path during what is intended to be local syntax validation.

Attack Path

1. The Skill modifies or validates a JavaScript or TypeScript file.
2. It invokes npx -y acorn without an exact version.
3. npx resolves the package using the current environment and registry configuration.
4. If remote resolution occurs, package content is downloaded outside the reviewed Skill package.
5. A compromised registry response, account, release, or package-resolution configuration supplies malicious code.
6. Package installation or execution code runs with the Agent's privileges.

Impact Assessment

A compromised dependency could execute arbitrary commands as the Agent, read accessible files and environment variables, modify the repository, and communicate over available network channels. Exploitation depends on package resolution and an attacker controlling or compromising the resolved dependency source; no evidence indicates that the legitimate acorn package is itself malicious.

Remediation

View remediation

Remediation Suggestions

Avoid automatic package retrieval during validation:

1. Declare an audited exact dependency version in the project manifest.

2. Commit and enforce the corresponding lockfile.

3. Install dependencies using lockfile and integrity verification.

4. Invoke the verified local binary, such as:

   bash

   ./node_modules/.bin/acorn --ecma2020 -- "$file" > /dev/null 2>&1
   

5. Fail safely if the local validator is unavailable rather than allowing npx to download it.

6. Where feasible, run validation in a sandbox with network access disabled and minimal filesystem permissions.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:219

Finding

Successful Runs Unconditionally Delete the Review Report

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 219
Vulnerability Type: Unsafe cleanup and unintended data deletion
Risk Level: Low

Vulnerable Code

bash

rm .beagle/ai-writing-review.json

Technical Analysis

The cleanup step unconditionally removes the review report after successful validation. It does not verify that the report was created by the current run, is untracked temporary data, or is safe to discard. It also does not ask for confirmation or preserve the report as audit evidence.

Although the workflow may create a Git stash when the workspace is dirty, that does not establish that this specific file is disposable or guarantee straightforward recovery in every repository state.

Attack Path

1. A repository contains .beagle/ai-writing-review.json, potentially as a tracked or user-maintained audit artifact.
2. The Skill loads the report and completes all modifications and validations successfully.
3. The cleanup step executes rm.
4. The report is deleted regardless of its ownership, provenance, tracking status, or retention requirements.

Impact Assessment

The primary impact is loss of review evidence or user-maintained data. If the file is not recoverable through Git or a backup, the deletion may be permanent. This issue does not provide an attacker with additional privileges or arbitrary deletion of attacker-selected paths because the documented target is fixed.

Remediation

View remediation

Remediation Suggestions

Preserve the report by default. If cleanup is required:

1. Delete only files created by the current invocation.

2. Record the generated file's canonical path and provenance at creation time.

3. Confirm that it is an untracked temporary file before deletion.

4. Request user confirmation when the file predates the run or is tracked.

5. Prefer archiving or renaming the report so it remains available as audit evidence.

6. Use an explicit end-of-options marker:

   bash

   rm -- .beagle/ai-writing-review.json
   

7. Clearly document recovery procedures and verify that a recoverable backup exists before cleanup.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (5)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

Partition remaining findings by `fix_safety`:

**Safe Fixes** (auto-apply):
- `chat_leak` - Delete conversational artifacts
- `cutoff_disclaimer` - Delete knowledge cutoff references
- `filler_phrase` - Delete filler phrases
- `heading_restatement` - Delete restating first sentence

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The skill instructs deletion of .beagle/ai-writing-review.json, which is a file operation with side effects and limited safeguards. Even though the target path is fixed, automatic removal of workflow artifacts can hinder auditability, erase evidence needed for recovery, and conditions users to accept destructive tool actions in a content-editing skill.

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

On successful completion (all validations pass):

bash

rm .beagle/ai-writing-review.json

If any validation fails, keep the file and report:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This skill is presented as a writing-humanization tool, but it also performs repository state changes such as stashing, checkout-based reverts, and cleanup of artifacts. Those actions are broader than necessary for the stated purpose and can surprise users, alter local state, or discard work if run automatically or misunderstood.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill includes external code-validation steps (python3, npx acorn) even though its primary function is rewriting prose and documentation. Expanding scope into language-tool execution increases attack surface, may execute unexpected tooling in untrusted repos/environments, and is not well aligned with the declared task.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The skill invokes npx -y acorn without pinning a version, which allows the latest package resolution at runtime and weakens supply-chain integrity. In a user-invocable skill that may run on developer machines or CI, this creates avoidable risk from unexpected package changes or a compromised upstream release.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.