Security audit

Operator Humanizer

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a local writing guide and analyzer, but it needs Review because it broadly encourages detector-evasive humanization, specific-person voice imitation, and hidden Unicode spacing in examples.

Review this skill before installing if you work in settings where authorship, consent, or disclosure matters. Do not use it to impersonate real people or evade policies, treat its AI-detection claims as rough style heuristics, and inspect generated output for hidden Unicode characters before publishing.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

other

Note

Location: references/examples.md:130
Finding: Invisible Unicode Separators Embedded in Social Media Output Template<![CDATA[ ## Vulnerability Details **File Location**: `references/examples.md:130-157` **Vulnerability Type**: Deliberate insertion of invisible Unicode characters **Risk Level**: Low ### Complete Code Snippet The invisible characters are represented below as `[U+2063 INVISIBLE SEPARATOR]` so that the affected lines can be inspected: ```markdown i just built a content database that remembers everything i've ever posted. [U+2063 INVISIBLE SEPARATOR] cost me like $6/month on supabase. took maybe 3 hours to set up. (honestly didn't think this would work but here we are) [U+2063 INVISIBLE SEPARATOR] now when i write something new, i can search my entire archive. no more rewriting the same thread 5 different ways because i forgot i already said it. [U+2063 INVISIBLE SEPARATOR] side note—realizing i've been saying basically the same 10 things for 2 years. kinda humbling ngl. [U+2063 INVISIBLE SEPARATOR] anyone else track their content like this or just me? ... **Added personality:** - ✅ Lowercase "i" (casual social style) - ✅ ⁣ spacing (Kevin's signature format) ``` ### Technical Analysis The template embeds U+2063 INVISIBLE SEPARATOR characters on lines that appear blank to a reader. The accompanying description explicitly identifies this invisible spacing as a signature formatting technique, indicating intentional rather than accidental use. Invisible formatting characters can cause two visually identical strings to have different byte or code-point representations. This can interfere with: - Text normalization and exact comparison - Content indexing and search - Plagiarism or duplication checks - Moderation and pattern-matching systems - Parsers that do not normalize Unicode consistently - Security logging and forensic review Ordinary Markdown blank lines provide the same visible paragraph spacing without hidden characters. The invisible separator therefore creates an unnecessary discrepancy between visible and machine-processed content. ### Attack Path ...[truncated 961 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace every U+2063 character with an ordinary Markdown blank line. 2. Remove the recommendation for invisible “signature” spacing. 3. If specialized formatting is required, use visible and documented Markdown or platform-supported formatting. 4. Add a repository check that rejects unexpected Unicode format characters, including characters in the Unicode `Cf` category. 5. Normalize generated output with Unicode normalization and explicitly remove zero-width or invisible separators unless a validated use case requires them. 6. Add tests that scan all documentation and templates for U+2063, U+200B, U+200C, U+200D, U+2060, and U+FEFF. ]]>

other

Note

Location: references/personality-injection.md:480
Finding: Invisible Unicode Separators Propagated Through Personality-Injection Guidance<![CDATA[ ## Vulnerability Details **File Location**: `references/personality-injection.md:480-490` **Vulnerability Type**: Hidden Unicode characters in a recommended output example **Risk Level**: Low ### Complete Code Snippet The affected invisible lines are represented as `[U+2063 INVISIBLE SEPARATOR]`: ```markdown **After (personality):** i just built a database that stores everything i've ever posted. [U+2063 INVISIBLE SEPARATOR] cost me like $6/month to run. [U+2063 INVISIBLE SEPARATOR] honestly didn't think this would work but now i have a content brain that remembers everything. (kinda weird seeing 5 years of thoughts in one place ngl) [U+2063 INVISIBLE SEPARATOR] anyone else wanna track their content like this? ``` ### Technical Analysis This reference guide places U+2063 INVISIBLE SEPARATOR characters inside an example that agents are expected to imitate when adding personality to generated text. Because the characters render as blank space, users may copy them without knowing that the output contains nonstandard format characters. The hidden characters can alter hashes, string equality, tokenization, filtering, and parser behavior while preserving the same visual presentation. Their placement in transformation guidance increases the chance that they will propagate into generated content. No encoded executable payload was found in these characters, and the project contains no Base64 decode-and-execute implementation. The risk comes from hidden text mutation and possible downstream filter inconsistency rather than local code execution. ### Attack Path 1. The Skill directs an agent to consult the personality-injection examples. 2. The agent follows or copies the social media example. 3. U+2063 characters enter the generated response between paragraphs. 4. The user copies the response into an external service. 5. The external service stores or evaluates a machine representation that differs from the visible text. 6. Exact-match detection, duplica ...[truncated 516 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Delete all U+2063 characters from the personality-injection example. 2. Use normal blank lines for paragraph separation. 3. Add a clear rule prohibiting invisible characters as a humanization or detector-evasion technique. 4. Sanitize example-derived output by removing unexpected Unicode format characters. 5. Add automated linting for invisible and zero-width Unicode characters across Markdown, source code, and generated fixtures. 6. Require explicit escaping and documentation for any format character that has a legitimate technical purpose. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description promises a substantial text-humanization capability: detecting a broad range of AI tells and actively converting text into authentic human writing. The code instead provides a command-line analyzer with three functions: score, analyze, and suggest. It computes simple stylometric metrics (burstiness, TTR, sentence CoV), checks against a few hardcoded word/phrase lists, and prints scores plus generic revision suggestions. That aligns partially with the 'checking for AI tells' portion of the description, but the primary claimed behavior—actually transforming text and injecting human personality/style—is absent. The implemented detection scope is also materially narrower than advertised. There are no suspicious undeclared permissions or resource accesses beyond reading local files, but the core purpose and capabilities are overstated relative to the code.

Natural-Language Policy Violations

High

Confidence: 96% confidence
Finding: The skill explicitly supports making text sound like a specific person, but includes no authorization, consent, or safety constraints. That can enable impersonation, fraud, social engineering, reputational harm, or bypass of authenticity checks by producing messages that mimic identifiable individuals.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The skill advertises extremely broad use cases for rewriting and humanizing text, which can cause it to trigger on ordinary writing requests without meaningful user intent checks. That makes it easier to apply the skill to deceptive content, evasion of AI-detection policies, or other misuse scenarios in contexts where provenance matters.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The file prescribes blanket bans on many ordinary words and treats normal vocabulary as evidence of AI authorship, despite no reliable basis for that inference. In a skill designed to 'humanize' text, this can push users toward deceptive stylistic manipulation, false positives in authorship judgments, and distorted writing guidance that suppresses legitimate expression.

Static analysis

No suspicious patterns detected.