Security audit

Humanize Text Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a local writing-editing skill with disclosed text analysis and rewrite behavior; the main caveat is repository hygiene around excluded development logs.

Install only from the filtered ClawHub package or verify that .omx development logs are not included. Use detect mode first for legal, compliance, technical, quoted, or externally sourced text, and provide voice samples only when you are authorized to adapt that writing style.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: .omx/logs/turns-2026-07-03.jsonl:1
Finding: Development Conversation Telemetry Stored in Plaintext
Content: View full analysis
Vulnerability Details

File Location: .omx/logs/turns-2026-07-03.jsonl:1
Vulnerability Type: Plaintext sensitive development telemetry
Risk Level: Medium

Evidence

json
{"timestamp":"2026-07-03T12:52:34.968Z","type":"agent-turn-complete","thread_id":"019f2809-5e20-7240-b846-3aba1900feb1","turn_id":"019f2809-888b-7b62-b139-b82829c3395e","input_preview":"You are a helpful assistant. You will be presented with a user prompt, and your job is to provide a ","output_preview":"{\"title\":\"Rename project to humanize-text-skil\"}"}

The same issue affects the other .omx/logs/turns-*.jsonl files. The audited records include prior prompt and response previews, stable thread and turn identifiers, development workflow details, repository operations, and local filesystem paths such as the developer's project directory.

Technical Analysis

The project artifact contains local agent telemetry that is unrelated to the Skill's declared text-analysis and rewriting functionality. The records are stored as readable JSON Lines without access controls, encryption, or sanitization.

An attacker does not need to execute the Skill or exploit its detector. Access to an unfiltered repository clone, source archive, backup, CI artifact, or incorrectly packaged release is sufficient to recover the stored metadata. Because prompt and response previews reflect historical agent sessions, future log entries could also capture credentials, private source fragments, unpublished repository information, or other sensitive user input.

.clawhubignore contains an .omx/ exclusion, which reduces exposure through correctly generated ClawHub packages. It does not remove the files from the audited source tree, repository history, general-purpose archives, backups, or distribution processes that do not honor .clawhubignore.

Attack Path

An attacker obtains an unfiltered copy of the project through a source archive, repository clone, ...[truncated 1196 chars]
Remediation: View remediation
Remediation Suggestions

Delete .omx/ from the distributable project tree and all release archives.

Add .omx/ to .gitignore in addition to the existing .clawhubignore rule.

Remove previously committed telemetry from repository history using an appropriate history-rewriting tool, then rotate any credentials if a separate secret scan finds exposed values.

Configure development tooling to store agent logs outside the repository.

Disable prompt and response previews where they are not required, or redact secrets, identifiers, personal data, and absolute paths before writing records.

Add automated release checks that reject archives containing .omx/, conversation logs, session identifiers, or known secret patterns.

Verify generated ClawHub packages and other distribution formats independently rather than relying exclusively on .clawhubignore.

Restrict filesystem permissions on development telemetry that must be retained and define an automatic retention period.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (59)

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · README.md (reported line 7)May include surrounding context.
md
### Make AI-written text sound human, not just less AI. **Bilingual zh/en engine · zero dependencies · detector + rewrite skill + voice pull** </div>

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · evals/real-samples.md (reported line 180)May include surrounding context.
md
### Make AI-written text sound human, not just less AI. **Bilingual zh/en engine · zero dependencies · detector + rewrite skill + voice pull** </div>

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · evals/real-samples.md (reported line 552)May include surrounding context.
md
### Make AI-written text sound human, not just less AI. **Bilingual zh/en engine · zero dependencies · detector + rewrite skill + voice pull** </div>

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/examples.md (reported line 285)May include surrounding context.
md
### Make AI-written text sound human, not just less AI. **Bilingual zh/en engine · zero dependencies · detector + rewrite skill + voice pull** </div>

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/examples.md (reported line 415)May include surrounding context.
md
### Make AI-written text sound human, not just less AI. **Bilingual zh/en engine · zero dependencies · detector + rewrite skill + voice pull** </div>

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/scene-packs.md (reported line 96)May include surrounding context.
md
### Make AI-written text sound human, not just less AI. **Bilingual zh/en engine · zero dependencies · detector + rewrite skill + voice pull** </div>

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/scene-packs.md (reported line 256)May include surrounding context.
md
### Make AI-written text sound human, not just less AI. **Bilingual zh/en engine · zero dependencies · detector + rewrite skill + voice pull** </div>

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose describes end-user functionality for auditing and rewriting text to sound more human. The actual code chunk does not analyze or rewrite user text at all. Instead, it is a development-time test that checks whether detector categories documented in CATEGORIES.md match the detector types implemented in code. This is a materially different primary purpose from the declared skill behavior, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description centers on auditing and rewriting text to remove AI tone and make it sound more human, including edit-in-place mode, protected spans, and voice profiles. The supplied code, however, is exclusively an end-to-end test for an analyzer (analyzeText). It verifies routing by language, issue detection tiers, score behavior, scene-based suppression, voice drift suggestions, classification probabilities, and edge-case handling. That aligns partially with a detect-only auditing capability and voice-profile analysis, but not with the broader declared rewrite-focused purpose. Important declared capabilities—especially rewriting/edit-in-place and protected spans—are not evidenced here. Because the code chunk’s primary observable behavior is analysis/testing rather than rewriting, this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents an end-user content-processing skill for detecting and rewriting AI-toned Chinese/English text into a more human voice. The supplied code does not implement that user-facing behavior. Instead, it is a test harness for the underlying engine/documentation: it loads README.md, executes analyzeText on canned examples, asserts exact scores/issue counts/voice drift values, and verifies that the README's stated CI test count matches the actual suite. This is a materially different primary purpose and includes file-reading/test-counting behaviors unrelated to the declared skill functionality. Therefore the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose is a rewriting/humanization skill that edits text to sound less AI-generated and match a target voice. The supplied code does not rewrite prose for tone or voice. Instead, it preprocesses text for detection by undoing obfuscation tricks (zero-width characters and homoglyph substitution) and stripping roleplay-action markers, explicitly so a classifier can use the normalization events as AI signals. That is a materially different primary purpose from tone editing or voice matching, so this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose centers on rewriting text to sound less AI-generated and more human, including voice matching and edit modes. The supplied code does not rewrite, transform, or adapt text at all. Instead, it performs trinary classification of text as human/mixed/AI and constructs highlighted sentence regions tied to detection issues. Detect-only support is mentioned in the description, but the primary declared capability is audit-and-rewrite for humanization, while this code is strictly a detector/classifier module. That is a materially different behavior and an undeclared capability set relative to the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description emphasizes auditing and rewriting content to remove AI tone and pull it toward a target human voice, including edit-in-place behavior, protected spans, and voice profiles. The supplied code is an analyzer/detector entry point: it routes English vs. Chinese text, normalizes text, detects vocabulary/pattern/stylometric markers, applies scene policy filtering, computes scores/classifications, highlights suspect sentences, and invokes voice analysis. It exports analysis functions and labels only. There is no code in this chunk that rewrites text, edits content in place, preserves protected spans during rewriting, or transforms text toward a target voice. Some declared concepts are partially aligned at the detection layer (bilingual support, detect-only, scene/context modes, voice analysis), but the primary implemented behavior is detection/scoring rather than rewriting/humanization. That is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is about text rewriting and voice/style transformation for Chinese or English content. The supplied code does not inspect or rewrite user text at all. Instead, it performs a repository maintenance task: counting markdown sections in SKILL.md and verifying that README.md contains a matching numeric summary. This is a materially different primary purpose and introduces undeclared behavior related to documentation validation and CI guardrails. While it does not appear harmful, it is clearly not implementing the described rewrite/audit skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents an end-user text rewriting skill focused on removing AI tone and adapting content to a target voice. The actual code chunk is an internal validation script for policy files used in CI: it imports a policy module, asserts presence and coverage of scenes/tiers/voices, and exits with failure on policy drift. This is a materially different primary purpose. While the code mentions scenes, tiers, and voice profiles, it only validates configuration integrity and does not process user text at all. Therefore the description does not accurately represent the supplied code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for a text-editing/audit skill focused on removing AI tone and rewriting content in a human voice. The supplied code does something materially different: it is an internal development utility that reads benchmark markdown, analyzes cases with a detector, and writes machine-verifiable fixtures for CI. This is not a supporting implementation detail of a rewriting skill; it is a test-fixture generation script for a detection engine. There is no evidence of text rewriting, voice matching, protected-span editing, or user-facing detect-only/edit-in-place behavior in this code chunk. Therefore the description does not accurately represent the actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for a natural-language rewriting skill focused on making text sound more human. The supplied code does not inspect, rewrite, or analyze user text at all. Instead, it is a maintenance script for syncing SKILL.md into a plugin directory and enforcing version consistency with plugin.json. That is a materially different primary purpose and introduces undeclared filesystem and manifest-validation behavior unrelated to the described skill functionality.
Content: No source excerpt is available for this finding.

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · evals/run-eval.md (reported line 89)May include surrounding context.
Quick run in Codex

bash
codex exec -C . --sandbox read-only \ "Read ./SKILL.md first, then the relevant files under ./references/, and evaluate every case in ./evals/benchmark.md. For SF cases, judge the scene, tier, rewrite tier, and scope first, then apply the rules and decide whether the case passes. If the sample is a README, release note, forum post, or issue reply, also read ./references/scene-packs.md and handle the matching sub-scene. If it is marked Long-form / in-place, obey the no-whole-sentence-deletion, no-adjacent-sentence-merge, and no-paragraph-reorder boundaries, and check retention, sentence alignment, and key transitions. Do a fidelity reread before any Residual Audit, and only run Residual Audit if the first pass preserved the facts but still leaves obvious AI residue. Residual Audit may check only opener residue, summary residue, narrator residue, vague judgment residue, and over-even sentence length, and it may only make light edits. Default to outputting the rewrite, but for unsupported-attribution samples that pass as audit-only, you may output just the sourcing or attribution risk note. Judge unsupported-attribution SF cases by scene: in public-writing or chat, deleting unsupported authority framing counts as a pass; in docs or status, clearly marking the missing source without presenting the claim as proven counts as a pass. For SNF cases, judge whether the tool creates false positives. In mixed samples, only touch the truly problematic body text; do not alter user instructions, quotations, or discussed terms. In code-context samples, edit only comments, docstrings, and commit messages. In Scene Packs samples, do not remove version numbers, paths, links, identifiers, or ownership. Finish with a summary table, SF pass rate, and SNF false-positive rate."

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The invocation examples are broad enough that the skill could activate on generic editing requests and steer the assistant toward 'humanizing' text that a user did not explicitly ask to transform in that way. In security-sensitive contexts, broad triggering can cause unintended rewriting of content, including policy, legal, technical, or evidentiary text where preserving exact meaning matters.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The default handling of underspecified phrases like 'take a look' or 'check this' is ambiguous and can silently choose detect/rewrite/edit behavior without clear consent. That increases the risk of scope creep, where the assistant analyzes or modifies content beyond what the user intended, especially for files where exact phrasing or confidentiality matters.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The frontmatter description is broad enough to match many ordinary prose-editing situations across common text file types, which increases the chance the skill activates when a user did not explicitly request this specialized behavior. Over-broad activation can cause unrequested rewriting of content, including sensitive documentation or text where preserving exact wording matters.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instruction 'Use this rule when the user wants prose to sound more natural' depends on ambiguous natural-language intent matching rather than deterministic activation conditions. This can misclassify generic editing requests and route content through a transformation workflow that changes tone, structure, or wording beyond what the user intended.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This code contains natural-language expectations that explicitly separate Chinese and English behavior and asserts language-specific outputs, such as forcing zh routing and Chinese-only connector suggestions. Under the policy rule, locale-specific constraints should offer user choice or be clearly justified; in this file they are embedded as mandatory behavior in tests rather than presented as optional or region-scoped.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file-level comment states the skill's purpose is to pull rewrites toward a target human voice, which is natural-language guidance embedded in the code. Framing this as imitation of a target voice can violate organizational policy expectations around user choice and disclosure, especially because no opt-in, restriction, or justification is stated here.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: detector/__tests__/patterns.test.js:214

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Evidence

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

External Model or Provider Selection

Quick run in Codex

Vague Triggers

Vague Triggers

Vague Triggers

Vague Triggers

Natural-Language Policy Violations

Natural-Language Policy Violations

Ae4

Static analysis

Shell command execution detected (child_process).