Security audit

Humanize Text Skill

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its writing-assistant purpose, but the submitted package includes unrelated local runtime logs and state that should not be installed with the skill.

Review before installing. The core skill appears local and purpose-aligned, but the package should be republished without .omx logs/state and with tighter activation wording for ambiguous review requests. Do not use custom voice samples to imitate another identifiable person without permission.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The operational log shows the agent claiming it can commit and push changes directly to GitHub, including to the main branch. That capability is unrelated to a text-humanization skill’s stated purpose and, if actually available, creates a high-risk path for unauthorized code or content modification, supply-chain tampering, and bypass of review controls.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The turn log shows the skill being used for tasks far beyond its stated purpose of humanizing or rewriting text, including GitHub workflow guidance, repository operations, and social-media/content strategy. This scope drift is dangerous because it weakens least-privilege boundaries and can normalize the skill being invoked for unrelated operational or influence tasks that may expose users to unsafe actions or policy bypass.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The log demonstrates the skill producing external organization and reputation analysis unrelated to text humanization, such as profiling HKUDS and generating persuasive social-media material from that analysis. This is risky because a rewriting tool should not silently expand into research or reputation-shaping functions, which can enable targeted persuasion, misinformation, or unsupported claims under the guise of simple editing.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The active-state file shows a cancellation skill triggered by the keyword "stop", which is a very common word in ordinary conversation. In an agent environment, this can cause accidental activation and unintended cancellation of workflows or interruption of other skills, especially when processing natural language inputs that frequently contain this term.

Vague Triggers

High

Confidence: 88% confidence
Finding: The default trigger mapping binds vague phrases like 'take a look' and 'check this' to detect mode, which can cause the skill to activate on generic review requests the user did not specifically intend for AI-style analysis. In multi-skill environments, ambiguous auto-selection can misroute content, produce unexpected transformations or classifications, and interfere with user intent, especially for sensitive drafts.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The activation description is broad enough to trigger in many ordinary writing contexts, including general documentation, emails, and social copy, without tight constraints on when the transformation is appropriate. That increases the chance the skill is invoked on sensitive prose where preserving exact wording, tone, or evidentiary value matters, leading to unnecessary or unsafe rewrites.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation guidance relies on vague intent phrases like wanting text to sound 'more natural' or 'less chatbot-like' without defining boundaries or refusal conditions. In practice, this can cause over-activation and stylistic rewriting of content that should remain precise, which is especially risky because the skill is designed to alter language while keeping facts ostensibly intact.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: The comments and implementation indicate the skill supports calibrating and matching a target human voice from a user-provided sample, which can enable style imitation beyond generic 'sound more human' rewriting. In a text-rewriting skill, this is more dangerous than in a neutral analytics context because it operationalizes stylometric mimicry without any visible consent, identity-targeting restrictions, or policy checks in this module.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The skill advertises broad natural-language triggers like 'rewrite this README intro so it sounds natural' without any exclusion guidance, which can cause an orchestrator to invoke the skill on loosely related requests. In an agent setting, ambiguous activation can lead to unintended text rewriting, scope creep, or modification of sensitive content the user did not explicitly ask to transform.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The default routing rules map vague everyday phrases like 'take a look' or 'check this' to specific operating modes. In a multi-skill agent, this ambiguity can trigger edits or analysis on the wrong artifact, especially when the request lacks a clear target, increasing the risk of unauthorized or accidental content changes.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: This section is entirely written in Chinese and presents core operational guidance without any visible bilingual fallback or documented locale constraint. In a general-purpose skill that advertises support for Chinese or English content, forcing operators or maintainers into one language can cause misunderstanding, missed safeguards, and incorrect use of rewrite rules, which is a real usability and security-quality risk even if not overtly malicious.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: detector/__tests__/patterns.test.js:214