AI Text Humanizer

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

Detected: suspicious.env_credential_access

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

An installer or host may need to provide API keys even though the registry metadata does not fully declare them.

Why it was flagged

The handler reads API keys from environment variables for caller authentication and Gemini access. This matches the integration purpose, but the registry metadata says no required env vars while SKILL.md/code show key usage.

Skill content

const expected = env('CLAW0X_API_KEY') ... const apiKey = env('GEMINI_API_KEY')

Recommendation

Store keys only in a secure secret manager or environment variable, and verify which party is hosting the handler and which key is actually required.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Any text submitted for humanizing may leave the local agent and be processed by an external AI provider.

Why it was flagged

User-supplied text is sent to the Gemini provider API for rewriting. SKILL.md discloses this, so it is purpose-aligned, but users should understand the external data flow.

Skill content

const url = `https://generativelanguage.googleapis.com/v1beta/models/${model}:generateContent?key=${apiKey}` ... contents: [{ parts: [{ text }] }]

Recommendation

Do not submit confidential, regulated, or proprietary text unless the Claw0x/Gemini data-handling terms are acceptable for that content.

NoteHigh Confidence

ASI09: Human-Agent Trust Exploitation

What this means

Using the skill may violate academic, workplace, publishing, or platform rules that require disclosure of AI-generated content.

Why it was flagged

The skill explicitly supports making AI-generated writing appear less detectable. This is disclosed and central to the purpose, but it can create policy or trust issues depending on the use case.

Skill content

User wants text to pass AI detection tools (GPTZero, Originality.ai, etc.)

Recommendation

Use it only where rewriting is allowed, and disclose AI assistance when rules or audience expectations require it.

NoteMedium Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users have less independent context for who maintains the skill or where to verify updates.

Why it was flagged

The artifact provides full SKILL.md and handler.ts content, but external provenance information is limited.

Skill content

Source: unknown; Homepage: none

Recommendation

Review the included source before use and prefer installing from publishers or repositories you trust.

Findings (1)

critical

suspicious.env_credential_access

Location: handler.ts:12
Finding: Environment variable access combined with network send.