Content Quality Pipeline

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:22 AM UTC
• Version: 1.0.1

Overview

This skill openly uses a third-party service to rewrite text so it passes AI detection, but its broad activation, missing privacy warning, and unpinned executable MCP package need review.

Review this carefully before installing. Do not use it on confidential, regulated, personal, legal, or proprietary text unless humantext.pro's data handling is acceptable to you. Pin and review the MCP package before running it, protect and rotate the API key, and avoid using the workflow to misrepresent authorship or bypass academic, platform, or workplace disclosure rules.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned Third-Party MCP Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:4 and SKILL.md:31-48; also documented in README.md:39-50
Vulnerability Type: Unpinned npm dependency with automatic remote package execution
Risk Level: Medium

Vulnerable Code

SKILL.md:4:

yaml

metadata: {"openclaw":{"requires":{"env":["HUMANTEXT_API_KEY"],"bins":["npx"]},"primaryEnv":"HUMANTEXT_API_KEY","install":{"npm":"@humantext/mcp-server"},"homepage":"https://humantext.pro"}}

SKILL.md:31-48:

json

{
  "mcpServers": {
    "humantext": {
      "command": "npx",
      "args": ["-y", "@humantext/mcp-server"],
      "env": {
        "HUMANTEXT_API_KEY": "htpro_your_key_here"
      }
    }
  }
}

README.md:39-50 repeats the same installation pattern:

json

{
  "mcpServers": {
    "humantext": {
      "command": "npx",
      "args": ["-y", "@humantext/mcp-server"],
      "env": {
        "HUMANTEXT_API_KEY": "htpro_your_key_here"
      }
    }
  }
}

Technical Analysis

The configuration invokes npx with -y and the unversioned package name @humantext/mcp-server. This causes npm to resolve the package version available from the configured registry and execute it without an interactive confirmation prompt. Neither an exact package version nor an integrity hash is specified.

Consequently, the code executed during a future invocation may differ from the code that was available when the Skill was reviewed. A compromised npm account, malicious package release, registry compromise, or unexpected upstream change could introduce arbitrary code into the local MCP process.

The process is explicitly supplied with HUMANTEXT_API_KEY. It also receives user-provided documents through MCP operations. Unless separately sandboxed, npm lifecycle behavior and the resulting server process may inherit the invoking user's filesystem, environment, and network permissions.

Attack Path

...[truncated 1438 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the MCP package to a reviewed exact version, for example:

   json

   {
     "command": "npx",
     "args": ["--yes", "@humantext/mcp-server@1.2.3"]
   }
   

   Replace the example version with a release that has been independently reviewed.

2. Prefer installing the dependency through a committed lockfile with npm integrity metadata rather than resolving it dynamically on every launch. Use npm ci in a controlled installation step and execute the locally installed binary afterward.

3. Verify package provenance, publisher identity, release signatures or attestations, and npm integrity hashes before deployment. Apply controlled dependency-update review instead of automatically accepting new releases.

4. Run the MCP server in a restricted environment with only the required network destinations, minimal filesystem access, and no unrelated environment variables. Avoid running it with administrator or root privileges.

5. Provide HUMANTEXT_API_KEY through a dedicated secret-management mechanism, scope and rotate the key where supported, and revoke it promptly if package compromise is suspected.

6. Clearly inform users that submitted text is processed by an external service. Users should avoid sending secrets, regulated data, or confidential documents unless the service's privacy and retention controls have been reviewed.

7. Consider removing -y from development and review workflows so unexpected installation or package-resolution behavior is not silently accepted.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill does not clearly warn that submitted text will be sent to a third-party service for detection and rewriting. Users may provide confidential, proprietary, academic, legal, or personal content without informed consent, creating privacy, compliance, and data-handling risks.

Content

No source excerpt is available for this finding.

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · README.md (reported line 38)May include surrounding context.

Add to your MCP configuration:

Claude Code (.claude/mcp.json):

json

{
  "mcpServers": {

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

Add to your MCP configuration:

Claude Code (.claude/mcp.json):

json

{
  "mcpServers": {

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The detect → humanize → verify pipeline creates a complete iterative evasion loop: test against a detector, rewrite, and re-test until the content is classified as human-written. The staged workflow materially increases danger because it turns a vague idea into a repeatable process for laundering authorship signals.

Content

No source excerpt is available for this finding.

Ssd 2

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This section operationalizes evasion by mapping detector-score thresholds to progressively stronger rewriting strategies and verifying whether the score drops. That directly optimizes content to defeat AI-detection systems, making misuse straightforward and scalable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README describes detection and humanization behavior but does not clearly warn that submitted text is transmitted to a third-party API. Users may paste sensitive drafts, internal documents, or personal data assuming local processing, creating confidentiality and compliance risks when that content is sent externally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example invocation is broad enough to match normal writing-assistance requests, which can cause the skill to activate unexpectedly and route ordinary user content into the pipeline. In this skill’s context, that means text may be sent to an external humantext.pro service for detection or rewriting without the user clearly intending that specific third-party processing.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The core purpose of the skill is to rewrite AI-generated content so it appears human-authored, then measure success with detector scores. That is an evasion workflow rather than ordinary editing, and it can facilitate academic dishonesty, policy evasion, and deception about authorship.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The activation scope is broad enough to trigger on generic writing and editing requests, which increases the chance the skill is invoked outside a narrowly intended context. In this skill, that matters because invocation can lead to third-party transmission of user content and participation in detector-evasion workflows without a clearly bounded use case.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.