亲笔写的

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:50 AM UTC
• Version: 1.0.2

Overview

This is a disclosed Chinese writing humanizer, but it is explicitly framed to hide AI authorship from a supervisor and its examples add unsupported personal and business claims.

Review carefully before installing. This skill may be useful for Chinese style polishing, but its default framing encourages hiding AI assistance in workplace or public writing. Do not use it where disclosure, authorship, academic, employer, platform, or client rules require transparency, and verify or replace any examples, metrics, citations, and personal experiences with facts you can support. Prefer a pinned or trusted installer path instead of the unpinned npx command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:20

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md:20-21
Vulnerability Type: Supply-chain risk from an unpinned executable dependency
Risk Level: Medium

Vulnerable Code

bash

# via npx (recommended)
npx skills add huangjihua007-rgb/qinbixiede

Technical Analysis

The recommended installation command invokes the skills package through npx without specifying an audited version or integrity value. Depending on the local npm and npx configuration, the command may retrieve and execute a mutable package version from the configured package registry.

The repository does not provide a lockfile, checksum, package signature, expected registry, or pinned package version for this command. Consequently, the behavior executed during installation can change after this repository has been reviewed. This creates a supply-chain trust boundary between the audited Skill and the independently maintained package resolved by npx.

The issue does not establish that the current dependency is malicious. The risk is that compromise, substitution, or an unexpected future release could introduce arbitrary installation-time behavior.

Attack Path

1. An attacker compromises the account, registry entry, publishing credentials, or distribution infrastructure associated with the skills package.
2. The attacker publishes a modified release containing malicious installation or runtime behavior.
3. A user follows the repository's recommended unpinned npx skills add ... command.
4. npx resolves and downloads the attacker-controlled version.
5. The downloaded package executes with the privileges of the user running the command.

Impact Assessment

Successful exploitation could allow arbitrary code execution under the installer user's account. Depending on that user's privileges and environment, the malicious package could read or modify user-accessible files, access environment variables and development creden ...[truncated 271 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the installer package to a specific, reviewed version rather than allowing mutable resolution.
• Document the expected package registry and package ownership.
• Publish and verify a cryptographic integrity hash or signature for the installer.
• Provide a lockfile or equivalent reproducible dependency manifest where supported.
• Recommend reviewing the resolved package and its installation scripts before execution.
• Avoid presenting mutable third-party package execution as the preferred installation method unless its provenance and integrity are verified.
• Consider supplying a non-executing installation path that downloads a versioned Skill archive and verifies its checksum before extraction.

other

Warning

• Location: examples/before_after.md:39

Finding

Examples Encourage Fabricated Personal Claims, Metrics, and Source Attribution

Content

View full analysis

Vulnerability Details

File Locations: examples/before_after.md:39-55, examples/before_after.md:89-105, examples/before_after.md:167-181; conflicting safeguard at SKILL.md:242
Vulnerability Type: Deceptive content fabrication
Risk Level: Medium

Relevant Content

The platform examples transform generic source text into claims equivalent to the following:

text

Last Friday afternoon, I was revising a presentation. When I reached the
third version, an intern beside me said that ChatGPT could finish it in
thirty seconds.

I work in content planning at an MCN company. Three months after the entire
team began using AI-assisted script writing, the manager dismissed two people.

A 2024 McKinsey report clearly states that AI improves completion rather
than the upper limit of quality.

Conclusion: AI tools now cover 60% of the department's repetitive work and
save approximately 120 labor hours per month.

The Skill separately states this safeguard at SKILL.md:242:

text

Do not invent details. If the source does not contain a concrete case,
mark a placeholder recommending that the user add a real experience
instead of creating one.

Technical Analysis

The examples introduce first-person employment experiences, personnel decisions, organizational performance figures, and an attributed report that were not present in the corresponding generic input. Because examples commonly guide model behavior, these transformations may outweigh or undermine the later instruction not to invent details.

This is not local code execution, privilege escalation, or system compromise. It is a content-integrity risk: generated material may represent synthetic details as personal experience, verified corporate data, or supported research. The report attribution is also incomplete because no report title, URL, page, or directly verifiable passage is supplied.

Attack Path

1. A user supplies g ...[truncated 1035 chars]

Remediation

View remediation

Remediation Suggestions

• Replace invented stories, percentages, staffing events, and performance measurements with explicit placeholders.
• Mark every hypothetical example as fictional and prohibit transferring its facts into user output.
• Require the agent to preserve factual provenance during rewriting.
• Require user confirmation before introducing first-person experiences or claims about an organization.
• Require complete, verifiable citation information before attributing a claim to a named source.
• Add an output validation step that compares factual entities, dates, figures, organizations, and personal experiences against the source text.
• If concrete details are absent, emit prompts such as [add your verified result] or [add your actual experience] rather than generating plausible details.
• Revise the examples so they consistently demonstrate the safeguard defined in SKILL.md:242.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill’s stated purpose is to detect 'AI traces' and rewrite text so it appears human-authored, including the explicit claim that leaders should not be able to tell it was written by AI. That is an evasion objective, not neutral editing assistance: it helps users conceal AI involvement from reviewers, employers, platforms, or integrity systems, increasing the risk of fraud, policy circumvention, and deceptive submissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is explicitly marketed as making text look human-written so that others, including supervisors, cannot tell it was AI-generated. In this context, the lack of any warning, policy boundary, or anti-deception guidance increases the risk of misuse for impersonation, academic/workplace dishonesty, and bypassing disclosure expectations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The phrase '让领导看不出是AI写的' explicitly targets deception of an authority figure, which materially elevates the risk beyond ordinary style editing. In context, the extensive workflow for spotting detectable patterns and rewriting them by platform makes the concealment operational and scalable, enabling users to pass off AI-generated work as their own in workplace or academic-like settings.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file presents all instructions and examples exclusively in Chinese, and there is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-language audience. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The README states the skill detects and fixes AI-generated Chinese text, and the examples and platform coverage are all Chinese-specific. This appears to impose a language-specific constraint without an explicit opt-in or justification in the documentation.

Content

No source excerpt is available for this finding.