ClawHub
Back to skill

Security audit

Humanize Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent writing/editing skill, but it needs review because it can use external web search on draft-derived claims by default and the published package includes prior agent session logs.

Install only if you are comfortable with a writing skill that may read user-selected samples/exports and use web search for fact checking. For confidential drafts, use a local-only workflow or explicitly tell the agent not to use web search. The publisher should remove the packaged .omx session files and tighten the detector-evasion appendix and external-search consent language before broad use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:82
Finding

Default Fact-Checking Can Disclose Sensitive Draft Content to External Search Providers

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 82–89 and 283–312
Vulnerability Type: Sensitive information disclosure through external searches
Risk Level: Medium

Vulnerable Instructions

text
2. **Balanced rewrite** — the default; run AI-pattern diagnosis, voice-aware rewriting, specificity and reasoning, light fact-check, and final audit.
text
3. **Search** in the right order: user-supplied evidence and local files first, then primary sources, then reputable secondary. The source tier matters — a peer-reviewed paper is not equivalent to an SEO blog. Record title, URL, date, and the exact claim each source supports.

Technical Analysis

The default Balanced rewrite mode automatically includes a fact-checking pass. The fact-checking instructions direct the agent to extract factual claims from a user's draft and search for external references using the permitted WebSearch and WebFetch tools.

Although the Skill appropriately prioritizes user-supplied evidence and local files, it does not require explicit user approval before transmitting claim-derived queries to an external search provider. It also does not require query minimization or redaction of names, identifiers, unpublished statistics, confidential product information, personal experiences, or regulated data.

Search queries are network disclosures. Consequently, a draft submitted only for rewriting may cause portions of its contents to be shared with a search service even when the user did not explicitly request web research. This exceeds the minimum privileges needed for local rewriting and voice editing.

Attack Path

  1. A user submits a confidential or unpublished draft for a normal rewrite.
  2. The Skill selects Balanced rewrite because it is the default mode.
  3. The agent extracts factual statements, including potentially sensitive names, figures, schedules, or product details.
  4. The agent converts those stat ...[truncated 966 chars]
Remediation
View remediation

Remediation Suggestions

  1. Make external fact-checking opt-in unless the user explicitly requested web research.
  2. Separate local claim review from network verification. Local review may run by default, but external searches should require confirmation.
  3. Before searching, display a concise list of proposed claims or generalized queries and ask the user to approve them.
  4. Prohibit sending verbatim private text, names, email addresses, account identifiers, unpublished figures, customer information, or regulated data to search providers.
  5. Require query minimization, such as searching for a general public proposition rather than copying an entire sentence from the draft.
  6. Add an explicit local-only mode that uses only pasted evidence and user-selected files.
  7. State in the final report whether external services were used and what categories of information were transmitted.
  8. Apply the same explicit, revocable consent standard used for live connectors to all external web research involving user content.

T09 · Insecure Skill Coding Practices

Warning
Location
.omx/logs/turns-2026-07-24.jsonl:1
Finding

Published Runtime Artifacts Expose Prior Session Metadata and Content Previews

Content
View full analysis

Vulnerability Details

File Location: .omx/logs/turns-2026-07-24.jsonl, lines 1–4; .omx/state/hud-state.json, lines 2–5; .omx/state/notify-hook-state.json, lines 2–8
Vulnerability Type: Plaintext development-session information included in the distributed artifact
Risk Level: Medium

Vulnerable Data

json
"thread_id":"019f9476-cb70-76f3-9d3f-1328f77d16c5"
"turn_id":"019f9476-cc8b-7130-9376-425d47fca84f"
"input_preview":"You are a helpful assistant. You will be presented with a user prompt, and your job is to provide a "
text
/Users/f/GitHub/humanize-skill/SKILL.md:23
json
{
  "recent_turns": {
    "019f9476-cb70-76f3-9d3f-1328f77d16c5|019f9476-cc8b-7130-9376-425d47fca84f|agent-turn-complete": 1784902246536,
    "019f9476-740b-7970-898a-0b3a0cb16ddb|019f9476-cb93-7741-80e5-2ba78d1531f2|agent-turn-complete": 1784902280771,
    "019f9477-41f8-75a1-a474-860591120eb0|019f9477-42c6-7380-80d6-3f8ee52c0d78|agent-turn-complete": 1784902305985,
    "019f9476-740b-7970-898a-0b3a0cb16ddb|019f9477-e0eb-71f0-ba74-0f37ae40225b|agent-turn-complete": 1784902340874
  },
  "last_event_at": "2026-07-24T14:12:20.875Z"
}

The runtime data also contains prior input and output previews, timestamps, commit metadata, and agent-hook state.

Technical Analysis

The distributed project artifact includes .omx runtime logs and state generated during previous agent sessions. These files are not necessary for the declared writing and fact-checking functionality.

The project already lists .omx/ in .gitignore, demonstrating that the directory is intended to remain local. Its presence in the audited package therefore indicates that release assembly did not enforce the repository's intended exclusion rules.

Ignore rules only affect ordinary source-control discovery; they do not protect files copied directly into an archive, included by an overly broad packaging command, or already trac ...[truncated 1470 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the entire .omx/ directory from the published artifact and from any existing release archives.
  2. Verify whether .omx was ever committed or published previously and purge sensitive history where appropriate.
  3. Build releases from an explicit allowlist containing only required Skill files, documentation, examples, assets, and license metadata.
  4. Use a clean source export rather than archiving the maintainer's working directory.
  5. Add CI checks that fail if runtime directories, prompt logs, session databases, editor state, local paths, or agent traces are present.
  6. Run secret and privacy scanners against the final release archive, not only the Git index.
  7. Configure the agent framework to store runtime state outside the project directory where possible.
  8. Minimize or disable prompt and output previews in persistent logs.
  9. Treat session and turn identifiers as sensitive metadata and rotate or invalidate them if they have meaning outside this snapshot.
  10. Document the release manifest and test it automatically so ignored development artifacts cannot reappear.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (17)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md
at Codex inbox or Slack use cases as integrations/workflows, not as proof of a `SKILL.md` skill. Prefer pasted samples, local files, exported archives, or a use

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 27)May include surrounding context.

md
Use it when a draft needs to become clearer, more specific, more faithful to the author, and safer to publish.

The public promise combines one reader-strategy layer with five rewrite promises:

- **Audience and cognition mapping**: identify the target reader, what they already know, what new cognition the text can offer, and which author persona should carry it.
- **Quality-first humanization**: make the draft clearer, more specific, and more credible instead of chasing detector scores.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The README first says the skill is not designed to bypass AI detectors, then later describes an alternative method specifically intended to lower detector scores. This contradiction weakens the safety boundary and creates a plausible deniability pattern where the tool can be marketed as safe while still providing actionable evasion techniques.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README explicitly documents an optional methodology whose stated purpose is to lower AI-detector classification scores. Even though it is framed as opt-in and non-default, publishing detector-evasion guidance meaningfully enables misuse by users seeking to evade academic, workplace, or platform integrity controls.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 205)May include surrounding context.

Clone directly into Codex's skills directory:

bash
mkdir -p ~/.codex/skills
git clone https://github.com/fendouai/humanize-skill.git ~/.codex/skills/humanize-skill

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 212)May include surrounding context.

Clone directly into Codex's skills directory:

bash
mkdir -p ~/.codex/skills
git clone https://github.com/fendouai/humanize-skill.git ~/.codex/skills/humanize-skill

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 221)May include surrounding context.

Clone directly into Claude Code's skills directory:

bash
mkdir -p ~/.claude/skills
git clone https://github.com/fendouai/humanize-skill.git ~/.claude/skills/humanize-skill

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 228)May include surrounding context.

Clone directly into Claude Code's skills directory:

bash
mkdir -p ~/.claude/skills
git clone https://github.com/fendouai/humanize-skill.git ~/.claude/skills/humanize-skill

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

This markdown file describes the skill's job in very general terms: improving writing quality and making text 'less inflated' or more in the user's voice. For a skill manifest/README, that scope is broad enough to overlap with many ordinary editing requests, and the file does not provide explicit trigger phrases or negative examples that sharply define when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The instruction to 'Infer the mode from the user's request' leaves substantial ambiguity about when the skill should activate and which mode should be chosen, especially for common writing requests. Without tighter constraints or examples, this can cause unintended invocation or inconsistent behavior across similar user prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file states that the skill can build a compact voice profile from local writing samples or user-provided exports, but it does not warn about the privacy and sensitivity of that data or explain consent, retention, and scope limits. Because voice profiles and writing exports can reveal identity, habits, and sensitive personal information, users may disclose more data than intended without understanding the risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

As a markdown file, this README should disclose behaviors that can affect user data or system state. The example command explicitly tells the skill to save outputs, but the surrounding text does not warn that this will create or overwrite local files or advise the user to confirm the target paths.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
70% confidence
Finding

This file embeds Chinese phrases as examples for identifying voice-matching requests, but it does not clarify whether multilingual handling is optional, user-driven, or limited to specific locales. While not strongly harmful, mixing locale-specific trigger cues without an explicit language-choice statement can create ambiguity around language policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The document states that when a user sample is missing, 'the skill writes flat,' which prescribes a specific default writing style. Under the policy, language or locale constraints should not be forced without user opt-in; this is a mild natural-language policy concern because it sets a default expressive mode rather than offering a user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The phrase 'The natural default voice carries the rewrite' indicates the skill will apply a default voice absent user-provided samples. This can be read as forcing a particular language/style policy without explicitly offering the user a choice, which falls under natural-language policy concerns.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The document instructs the rewrite to use a specific narrative style, including first-person perspective, as part of the voice profile. That is a natural-language constraint on output style, and the file does not indicate that the user is offered a choice or opt-in for this language/voice setting.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

L155 says the rewrite should be 'signed with the user's name,' which implies a real user name will appear in the output. L163 directly contradicts that by stating the rewrite 'does not include the user's name' because it was not supplied, and that '[name]' is kept instead.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.