Security audit

Human Voice Content Editor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple content-editing aid with disclosed local file input/output and no evidence of hidden access, persistence, network use, or credential handling.

Install only if you want a lightweight local editing aid. Do not rely on the bundled script for factual verification, hallucination detection, scoring, or a complete audit; review rewritten content yourself, and be careful when choosing an output path because an existing file may be overwritten.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose claims auditing for AI-generated feel, hallucination-risk flagging, and broad humanization, but the referenced behavior reportedly only performs limited substitutions and file I/O. This mismatch is dangerous because users may trust the skill to detect unverifiable claims or meaningfully review content quality when it does not, leading to publication of inaccurate or noncompliant material under a false sense of assurance.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises and documents file-writing behavior via a CLI workflow, but the manifest shown does not declare any explicit tool scope or permissions. That creates an authorization and review gap: downstream systems or operators may invoke a skill with broader file-write capability than intended, increasing the chance of unintended file modification or use in automation chains without clear consent boundaries.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger language is very broad, covering common requests like making content sound more human or fixing tone, which can cause the skill to auto-activate in many ordinary editing contexts. Over-broad activation increases the risk of unrequested rewriting, loss of user intent, or accidental execution of file-modifying workflows in situations where the user only wanted light editing or review.

Natural-Language Policy Violations

Medium

Confidence: 82% confidence
Finding: The documentation prescribes a fixed English-language stylistic transformation without asking for user opt-in, locale, dialect, or audience constraints. In context this is less severe than a direct security bug, but it can still cause harmful content alteration, cultural/locale mismatch, or unintended policy and brand deviations when applied automatically across diverse content.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill metadata promises hallucination-risk detection and broader AI-tone auditing, but the implementation only performs a few literal word substitutions and removes bold markdown markers. This mismatch can cause users to rely on the tool for safety or factuality checks it does not actually perform, leading to unreviewed false claims being preserved and output presented with misplaced confidence.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: This code writes transformed content to a user-supplied file path when --output is provided, but there is no confirmation prompt, log message, or explanatory comment/docstring disclosing that the file will be created or overwritten. For code files, file writes should have some visible disclosure unless clearly covered elsewhere.

Static analysis

No suspicious patterns detected.