tone-rewriter

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:59 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent paid tone-rewriting service, but it should be reviewed because it sends user text to an external paid endpoint and asks for a global payment CLI install and login.

Install only if you are comfortable using the awal CLI for authentication and payments. Before invoking it, confirm the exact text can be sent to the external endpoint and use a low-risk payment setup because each request is charged.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unreviewed Third-Party Package Executes Globally and Handles Authentication and Payments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-27
Vulnerability Type: Third-party supply-chain exposure through globally installed executable dependency
Risk Level: Medium

Vulnerable Code:

bash

npm install -g awal@2.0.3
awal auth login

bash

npx awal@2.0.3 x402 pay https://anicca-proxy-production.up.railway.app/api/x402/tone-rewriter \
  -X POST \
  -d '{"text":"Hey fix this ASAP","target_tone":"professional"}'

Technical Analysis

The Skill instructs users to install awal@2.0.3 globally and execute it for authentication, payment, and transmission of user-provided text. Pinning the package version reduces version drift, but the Skill provides no lockfile, package-integrity hash, provenance verification, or documented security review of the dependency.

A global npm installation may execute package lifecycle scripts and installs executable code outside a project-scoped environment. The subsequent npx invocation executes the same third-party package while it processes an external API destination, payment operation, request body, and authentication context. If the package, its transitive dependencies, or its published artifact were compromised, arbitrary code could execute with the privileges of the invoking user.

The documented external API transmission and USDC charge are consistent with the stated purpose of the Skill and are not themselves evidence of malicious intent. The identified risk is the unnecessary global installation and unverified trust placed in executable third-party supply-chain code.

Attack Path

1. An attacker compromises the referenced npm package, one of its transitive dependencies, or the package publication process.
2. A user follows the Skill instructions and runs npm install -g awal@2.0.3.
3. Malicious package installation hooks or CLI code execute locally with the invoking user's privileges.
4. The user runs awal auth login, exposin ...[truncated 1192 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the global installation requirement and install the dependency in a project-scoped, isolated environment.
2. Maintain a reviewed package.json and lockfile that pin both direct and transitive dependencies.
3. Verify the package publisher, repository, release provenance, and npm artifact integrity before use.
4. Use integrity hashes or signed provenance attestations where supported.
5. Disable npm lifecycle scripts during installation unless they are explicitly required and reviewed, for example by using --ignore-scripts.
6. Run the CLI with least privilege in a restricted container or sandbox with limited filesystem, environment-variable, credential, and network access.
7. Avoid exposing broad wallet or payment authority to the CLI. Use a dedicated low-value wallet or narrowly scoped payment authorization.
8. Obtain explicit user consent before sending text to the external service, especially where submitted content may contain confidential or personal information.
9. Document the external service's ownership, data retention, privacy policy, credential handling, and incident-response process.
10. Consider replacing the executable payment client with a reviewed implementation or direct API integration that minimizes trusted code and validates the destination, amount, network, and response before authorizing payment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description contains broad trigger phrases such as 'rewrite text', 'change tone', and 'professional rewrite', which can cause the skill to be selected for many common user requests without clearly signaling that it is a paid remote service. This increases the chance of unintended invocation, unnecessary payment, and transmission of user text to an external endpoint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs agents to send arbitrary user-provided text to a third-party endpoint and incur payment, but it does not provide a prominent user-facing warning or consent requirement. In context, this is more dangerous because the skill handles free-form text that may contain sensitive personal, business, or secret information, creating privacy and billing risk if invoked automatically.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.