ClawHub
Back to skill

Security audit

humanizer-zh

Security checks for vulnerabilities and agentic risk

Overview

The skill itself is a coherent Chinese text-editing guide, but its recommended unpinned npx install path creates avoidable supply-chain risk.

Install only after reviewing the source you are actually installing. Prefer the manual or git-clone path pinned to a trusted commit instead of the recommended unpinned npx command, and use the skill only on text or files you are comfortable having rewritten.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:24
Finding

Unpinned Third-Party Installer Executes Mutable Remote Content

Content
View full analysis

Vulnerability Details

File Location: README.md:24
Vulnerability Type: Supply-chain risk from an unpinned executable dependency
Risk Level: Medium

bash
npx skills add https://github.com/op7418/Humanizer-zh.git

Technical Analysis

The recommended installation command invokes the unversioned skills npm package through npx. If the package is not already available locally, npx can retrieve and execute its currently resolved release. The package version is not pinned, and the referenced Git repository is not fixed to a reviewed commit or verified with a cryptographic hash.

Consequently, the code and Skill content executed or installed by this command can differ from the content reviewed during this audit. This exceeds the privileges required to install a documentation-only Skill because installation could instead be performed by reviewing and copying the two Markdown files without executing a mutable third-party installer.

No evidence was found that the currently audited files contain a malicious payload. The vulnerability is the unsafe trust boundary created by the documented installation process.

Attack Path

  1. An attacker compromises the npm account, package publication pipeline, GitHub account, or referenced repository.
  2. The attacker publishes a malicious version of the skills package or modifies the repository's default branch.
  3. A user follows the recommended installation command.
  4. npx resolves and executes the unreviewed package version with the user's local privileges.
  5. The compromised installer may execute arbitrary actions available to that user or install modified Skill instructions.
  6. The altered Skill content may subsequently affect agent sessions whenever the installed Skill is activated.

Impact Assessment

Successful exploitation could provide code execution under the account running npx, subject to that account's operating-system permissions. Potential ...[truncated 430 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the npm CLI to an explicitly reviewed version, for example by using npx skills@<reviewed-version>.
  2. Pin the Git repository to a reviewed immutable commit rather than its mutable default branch.
  3. Publish and verify cryptographic hashes for the installed SKILL.md and README.md files.
  4. Prefer a manual installation procedure that downloads, reviews, and copies the Markdown files without executing third-party installer code.
  5. If an installer remains necessary, run it in a restricted environment without credentials or access to sensitive user files.
  6. Document the exact expected package version, repository commit, file hashes, and verification commands.
  7. Avoid labeling an unpinned npx command as the recommended installation method.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The README instructs users to install and execute an unpinned remote package via npx skills add .... Because npx resolves packages dynamically, a compromised or updated package could run unexpected code at install time, creating a supply-chain risk even though the referenced GitHub repo itself is explicit.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

触发条件“编辑或审阅文本，去除 AI 写作痕迹”过于宽泛，容易与普通编辑、润色、审阅类请求重叠，从而在非预期场景被自动调用。误触发本身不会直接造成代码执行，但会导致模型在错误上下文中改写用户内容、覆盖原始风格或引入不必要的文本变更。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

技能正文和输出规范整体强制以中文表达，但没有提供语言协商机制，也未明确声明仅适用于中文输入/输出。若在其他语言场景中被触发，可能导致未经请求的语言切换、语义细节丢失，甚至在安全敏感编辑任务中错误改写原文含义。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.