Humanizer by JZ

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:19 AM UTC
• Version: 1.0.0

Overview

This is a coherent text-editing skill for making writing sound less AI-generated, with no hidden execution or persistence, though its install command and edit scope deserve user attention.

Installers that use `latest` can change over time, so prefer a pinned and trusted ClawHub installer version when possible. When using this skill, give explicit instructions about whether you want an in-place file edit or only a proposed rewrite, and specify the desired language, audience, and tone so the broad style rules do not over-edit your text.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:14

Finding

Unpinned Remote Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 14-16
Vulnerability Type: Execution of a mutable third-party package version
Risk Level: Medium

bash

npx clawhub@latest install humanizer

Technical Analysis

The documented installation command uses npx to download and execute the latest version of the third-party clawhub package. The latest tag is mutable, and neither a fixed package version nor an integrity value is provided. Consequently, the code executed by this command may differ from the version that existed when the project was audited.

npx executes the downloaded package with the permissions of the user running the command. If the package, its publishing account, or an upstream dependency is compromised, malicious package or lifecycle code could run during installation. Pinning only the Skill version would not address this exposure because the installer package itself is currently unpinned.

Attack Path

1. An attacker compromises the clawhub package, its registry publishing credentials, or a dependency included in a future release.
2. The attacker publishes a malicious release and assigns it to the mutable latest distribution tag.
3. A user follows the installation command from README.md.
4. npx retrieves and executes the attacker-controlled release.
5. The malicious code operates with the invoking user's privileges and may access resources available to that account.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the invoking user's account. Depending on that account's permissions and environment, the malicious package could read or modify project and user files, access environment variables or locally stored credentials, alter installed Skill content, or download additional payloads.

The command does not directly grant administrative privileges. The attainable scope is limited to the permissions and credentials avai ...[truncated 110 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable latest tag with an explicitly reviewed package version:

   bash

   npx clawhub@<reviewed-version> install humanizer
   

2. Commit an appropriate lockfile where the installation workflow permits it, and ensure transitive dependencies are resolved to reviewed versions.
3. Verify package integrity and provenance using registry checksums, signatures, or attestations before execution.
4. Retrieve packages only from an explicitly configured, trusted registry rather than relying on ambient registry configuration.
5. Review package lifecycle scripts and dependencies before publishing the recommended installation command.
6. Run installation from a minimally privileged account or isolated environment without unrelated credentials or sensitive files.
7. Establish a controlled update process in which newer installer versions are reviewed and tested before the documentation is updated.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The installation command uses npx clawhub@latest, which pulls and executes the latest published package version at runtime rather than a pinned, reviewed release. This creates a supply-chain risk: if the package is compromised or a breaking/malicious update is published, users following the README could execute untrusted code on their systems.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented trigger phrases are very broad (Humanize this text, Review this draft for AI patterns and fix them) and can overlap with ordinary editing or review requests. In an agent environment, this can cause the skill to activate unexpectedly on unrelated user content, which increases the chance of unintended prompt interception, hidden instruction processing, or unauthorized text transformation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This section prescribes a specific Chinese-language register and platform-specific style choices, including banned openings and required colloquial substitutions, without stating that these rules apply only when the user wants Chinese output in that style. That creates a locale/language policy issue because the skill imposes a language-specific communication norm rather than offering it as an option.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest explicitly enables Write and Edit capabilities, and the task instructions direct the agent to rewrite text, but the markdown does not clearly warn users that their content may be changed in-place or written back to files. For a text-editing skill, this is a user-data-affecting behavior that should be disclosed so users know whether to expect direct file modification versus a suggested rewrite only.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.