Humanizer Academic ZH

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:13 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Chinese academic rewriting prompt, but it explicitly aims to reduce AI-detection signals and has broad activation and installation caveats users should review carefully.

Install only if you specifically want this behavior and are allowed to use it under your school, journal, employer, or disclosure rules. Prefer manual review and installation over unpinned npx, avoid pasting confidential or unpublished research into unapproved AI services, and disable the system prompt outside intentional editing sessions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:27

Finding

Unpinned npm Package Execution in Recommended Installation Workflow

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 27–42
Vulnerability Type: Supply-chain risk caused by executing an unpinned third-party package
Risk Level: Medium

The recommended installation workflow invokes the skills npm package through npx without specifying a package version or integrity constraint:

bash

npx skills add cangtianhuang/humanizer-academic-zh

The related management commands are also unpinned:

bash

npx skills list

bash

npx skills update cangtianhuang/humanizer-academic-zh

bash

npx skills remove cangtianhuang/humanizer-academic-zh

Technical Analysis

When the requested package is unavailable locally, npx can download and execute the version currently resolved from the npm registry. Because the documentation does not specify a reviewed version, lockfile, or integrity hash, the code executed by these commands may change independently of the audited project.

This creates a supply-chain trust boundary outside the repository. If the npm package, its maintainer account, one of its transitive dependencies, or the package-resolution process is compromised, a subsequently published payload could execute when a user follows the documented instructions. Execution may occur through the package CLI or applicable package lifecycle behavior.

The commands are not evidence that the current package is malicious. The vulnerability is the absence of version and integrity controls around third-party code execution.

Attack Path

1. An attacker compromises the skills npm package, its publishing account, or a dependency included in a future release.
2. The attacker publishes a malicious version that is selected by the unpinned package resolution.
3. A user follows the README and runs npx skills add cangtianhuang/humanizer-academic-zh, or one of the other documented npx skills commands.
4. npx retrieves the unresolved current package versi ...[truncated 838 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to a specific reviewed version in every documented command, for example:

   bash

   npx --yes skills@<reviewed-version> add cangtianhuang/humanizer-academic-zh
   

2. Verify the selected release and its dependency tree before recommending it. Update the pinned version only after reviewing the new release.

3. Where practical, use a package manager lockfile and npm integrity metadata so package contents are reproducible and verifiable.

4. Document the expected npm package publisher, registry, version, and package provenance to reduce dependency-confusion and registry-substitution risks.

5. Recommend running installation without administrator privileges and in an environment that does not expose sensitive credentials.

6. Prefer the manual installation procedure for security-sensitive environments because it copies the reviewed SKILL.md file without executing a third-party package manager CLI.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill metadata explicitly states goals such as “去除AI味” and “降低AIGC检测率,” which are direct indicators that the skill is intended to help users evade AI-content detection rather than perform neutral editing. A tool optimized for concealment of AI origin can facilitate academic dishonesty, policy circumvention, and deceptive submission of machine-generated work as human-authored content.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README says the System Prompt can be pasted into an LLM's system prompt field and then activated in any conversation, with no boundary on when it should or should not apply. A broadly scoped system prompt can unintentionally affect unrelated chats, causing undesired rewriting behavior, prompt persistence across tasks, or mishandling of content not intended for this skill. In this skill's context, the risk is increased because it is designed to transform academic text to evade AI-detection heuristics, so accidental activation can create integrity and misuse concerns.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README encourages copying the prompt into third-party LLM systems but does not warn that pasted manuscript content may be transmitted to external providers and retained under their policies. Users may unknowingly submit unpublished research, student work, or sensitive academic material, creating confidentiality, compliance, and intellectual-property exposure. The risk is more significant here because the skill is specifically intended for processing manuscript text, which is often private before publication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The usage section tells users to paste paper excerpts directly for rewriting but omits any warning about privacy, confidentiality, or institutional restrictions on sharing manuscript text with an AI service. That omission can lead users to expose unpublished research, peer-review content, or personal data embedded in drafts. Because the skill is aimed at academic text transformation, the likelihood of sensitive inputs is relatively high, making the documentation gap more consequential.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description includes broad phrases like “帮我改改这段” and “这段读起来像AI写的,” which can cause the skill to activate for ordinary editing or writing-assistance requests outside the intended academic context. Over-broad invocation increases the chance that users are routed into a workflow explicitly designed to remove AI traces and lower detection, which expands misuse surface and reduces user intent clarity.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The description frames the skill as helping rewrite text to evade AI-generation detection, which goes beyond benign proofreading and into active assistance for bypassing integrity controls. In an academic setting, this can be exploited to disguise AI-written assignments or manuscripts, undermining institutional review, authorship transparency, and trust in submitted work.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The body of the skill repeatedly instructs the agent to “识别并消除…AI生成痕迹,” reinforcing a sustained detection-evasion objective rather than incidental style improvement. This repeated emphasis makes the context more dangerous, because the entire workflow is tuned to systematically alter text specifically to hide machine-generation signals, not just to improve prose quality.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The title and core instruction specify that the skill is exclusively for Chinese academic writing and directs the model to rewrite text to conform to Chinese scholarly style. This imposes a language/locale constraint without offering user opt-in or documenting a region-specific compliance need, which matches the policy's language/locale violation criterion.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.