Back to skill

Security audit

Humanize Chinese

Security checks for vulnerabilities and agentic risk

Overview

This skill runs local Chinese text detection and rewriting scripts, with disclosed file output and no evidence of hidden persistence, network access, or exfiltration.

Install only if you want a Chinese-specific text rewriting utility that runs bundled Python scripts locally. Review output paths before using file or batch examples, since they can create rewritten files, and be aware that optional style conversion goes beyond simple de-AI polishing.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (22)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
声明描述的是一个“检测并去除 AI 味”的双功能工具,重点包含改写输出与对比报告;而代码仅是检测脚本(detect_cn.py),核心行为是扫描中文文本中的模式、计算 0-100 分数、分类列出问题,并在详细模式下给出可疑句子。输入方式与声明中的“支持文件输入或粘贴文本”基本一致,但最关键的输出和主要能力明显不符:没有任何重写、编辑、润色、替换或生成新文本的逻辑,也没有前后版本比对。故属于明显的描述与实际行为不一致,且实际主用途比声明更窄,仅为检测而非去除。

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
该代码的核心功能与描述大体相关,都是对中文文本进行去AI感改写,且支持文件输入与直接文本输入,也适用于不同场景,因此整体方向一致。但描述中包含两项关键能力未在代码中实现:第一,所谓“检测AI写作痕迹”并不存在,代码没有分析、评分、标注或识别机制,只是直接进行规则化改写;第二,描述承诺“输出改写后文本和对比报告”,而代码仅输出改写结果,没有生成前后差异报告、修改说明或检测报告。此外,代码还包含一个可选的 --style 参数,会调用外部 style_cn.py 做风格转换,这属于额外能力,描述中未体现。基于这些差异,属于描述与实际行为不完全匹配,且偏差具有实质性。

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
代码标题、数据结构和主流程都表明其核心目的是‘中文文本风格转换’。它通过一组 transform_* 函数对文本做规则式改写,例如替换正式/口语词、插入emoji、缩短段落、增加平台化措辞等,并依据 --style 参数选择不同风格。虽然其中某些变换(如口语化、去正式结构)可能在效果上偶尔让文本‘没那么像机器写的’,但这只是风格改写的副作用,不等同于声明中的‘检测并去除AI写作痕迹’。此外,代码没有任何检测模块、没有输出对比报告、也没有围绕用户触发词进行逻辑判断。因此声明与实际行为存在明显且实质性的目的与能力不一致。

Lp1

High
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The script has undeclared shell/process-execution capability because it launches other Python programs via subprocess. In an agent skill ecosystem, missing permission declarations can bypass security review expectations and allow execution behavior that operators or sandboxes did not explicitly approve.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The manifest describes a skill that should 'detect and remove' AI-writing traces and output rewritten text plus a comparison report. This file implements only detection, scoring, sentence analysis, and report formatting, with no rewriting or text transformation logic anywhere in the execution flow.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger phrases are broad and overlap with ordinary editing requests such as '帮我润色' or '改得自然一点', increasing the chance the skill activates in situations the user did not intend. In a skill with write and exec capabilities, overbroad routing can cause unnecessary file modification or command execution during normal writing assistance tasks.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill advertises file writing and shell execution without any clear warning that using it may modify files or run local commands. This is dangerous because users may provide text for simple polishing while the agent is empowered to persist changes or invoke scripts, creating a consent and transparency gap.

Session Persistence

Medium
Category
Rogue Agent
Content
description: 检测并去除中文文本中的AI写作痕迹。当用户说"去AI味"、"改得自然一点"、"太机器了"、"帮我润色"、"去掉AI感"时使用。支持文件输入或直接粘贴文本,输出改写后文本和对比报告。适用于论文、文案、公众号、社交媒体等场景。
allowed-tools:
  - Read
  - Write
  - Edit
  - exec
---
Confidence
84% confidence
Finding
This duplicated RA2 finding is still valid: the combination of persistent file modification permissions and execution capability enables lasting changes in the working environment. Because the skill includes examples that save outputs and process batches of files, accidental or overbroad invocation could affect many files in one session.

Session Persistence

Medium
Category
Rogue Agent
Content
description: 检测并去除中文文本中的AI写作痕迹。当用户说"去AI味"、"改得自然一点"、"太机器了"、"帮我润色"、"去掉AI感"时使用。支持文件输入或直接粘贴文本,输出改写后文本和对比报告。适用于论文、文案、公众号、社交媒体等场景。
allowed-tools:
  - Read
  - Write
  - Edit
  - exec
---
Confidence
84% confidence
Finding
This duplicated RA2 finding is still valid: the combination of persistent file modification permissions and execution capability enables lasting changes in the working environment. Because the skill includes examples that save outputs and process batches of files, accidental or overbroad invocation could affect many files in one session.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill declares exec capability even though its stated purpose is text processing, which expands the attack surface unnecessarily. In this context, the workflow explicitly instructs the agent to run shell commands and Python scripts, so a compromised or modified script path could execute arbitrary code or perform unintended system actions.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
cmd.append('-j')
    
    try:
        result = subprocess.run(
            cmd, input=text, capture_output=True,
            text=True, encoding='utf-8', timeout=30
        )
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
cmd.append('-j')
    
    try:
        result = subprocess.run(
            cmd, input=text, capture_output=True,
            text=True, encoding='utf-8', timeout=30
        )
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
This code file contains user-facing strings such as status messages, errors, headings, and argument descriptions entirely in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the locale restriction is clearly documented and justified, which is not present here.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The file’s natural-language description states it is a Chinese AI text detector and all user-facing CLI descriptions and outputs are only in Chinese. This imposes a specific language/locale without offering a choice or documenting a justified region-specific restriction, which matches the policy-violation criterion for forced language selection.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The module description and transformation logic explicitly target Chinese text only, and the command-line interface is also presented solely in Chinese. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale constraint that should be documented as optional or justified.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The manifest limits the skill to making Chinese text sound less AI-generated and returning rewritten text plus a comparison report. In addition to humanization, the CLI exposes `--style` and conditionally runs `style_cn.py` to perform a separate style transformation, which expands the skill's behavior beyond what the manifest claims.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The manifest describes detecting and removing AI-writing traces from Chinese text, with file or pasted-text input and rewritten output. This code adds a `--style` feature that shells out to another script using `subprocess.run`, introducing process-execution capability that is not an obvious requirement of the stated purpose and is not mentioned in the manifest.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
tmp_path = tmp.name
            
            try:
                proc = subprocess.run(
                    ['python3', style_script, tmp_path, '--style', args.style],
                    capture_output=True, text=True, encoding='utf-8'
                )
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
This JSON file is entirely specialized for Chinese-language detection and rewriting, with Chinese regexes, phrases, and descriptions throughout. Because the file does not document any user choice, opt-in, or justified region-specific scope, it appears to enforce a specific language/locale in a way that can violate language/locale policy.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The manifest describes a narrowly scoped '去AI味/润色' skill for making Chinese text sound more natural, with output including rewritten text and a comparison report. The file docstring and implementation expose a broader style-transformer that rewrites text into specific personas such as 小红书、公众号、知乎、学术、文艺、微博, which is materially different from simply removing AI traces.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
A skill meant to reduce AI feel and make text more natural would not ordinarily include a mode that converts colloquial phrasing into more formal academic language. This is not an implementation detail of humanization; it is a separate rewriting capability with a different user intent.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The CLI description explicitly defines the tool as '中文文本风格转换 v2.0', and the supported transformations and prompts throughout the file are all hard-coded for Chinese text only. This is a natural-language locale constraint with no user choice or opt-in mechanism, and there is no documented justification that the skill is intended only for a region-specific or compliance-bound use case.

Static analysis

No suspicious patterns detected.