english-polish

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:33 AM UTC
• Version: 1.0.1

Overview

The skill mostly does what it claims, but its report and diff helpers use unsafe local-file handling that users should review before installing.

Review this skill before installing if you will process sensitive documents, run on shared machines, or open generated HTML reports. Avoid running it with elevated privileges, avoid untrusted filenames or broad custom regex patterns, and prefer a patched version that uses tempfile or in-memory diffs plus HTML escaping.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/detector.py:531

Finding

Stored HTML Injection in Generated Reports

Content

View full analysis

{ex[:80]}{"..." if len(ex) > 80 else ""}' for ex in cat["examples"][:5] ) ``` ```python # scripts/detector.py:559-561 Detector Report{f' — {filename}' if filename else ''}

Phase 0 Detector Report{f' — {filename}' if filename else ''}

``` ```python # scripts/polish.py:642 Polish Report — {filename} ``` ```python # scripts/polish.py:654

Polish Report — {filename}

``` ### Technical Analysis The report generators construct HTML with Python formatted strings and insert filenames and detected source-text matches directly into the markup. These values are not passed through an HTML-escaping function. On filesystems that permit HTML metacharacters in filenames, an attacker can create a document whose filename contains elements such as ``, `

Remediation

View remediation

{escape(str(ex[:80]), quote=True)}" for ex in cat["examples"][:5] ) ``` 3. Apply escaping consistently in both `format_report_html()` and `_polish_report_html()`. Do not rely on input validation alone, because valid filenames and document text can contain HTML metacharacters. 4. Consider using a template engine with automatic HTML escaping if report complexity increases. 5. Add regression tests covering filenames, pattern labels, matches, and change descriptions containing: - `

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/polish.py:389

Finding

Predictable Shared Temporary Files Permit Symlink Overwrites and Data Exposure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code does not perform English polishing, style correction, or diff generation. Instead, it acts as a maintenance/reporting script for benchmark baselines: it reads a detector report, calculates average scores, saves a reference JSON, and compares current results to that reference. This is materially different from the declared primary purpose. While it is plausibly related to the broader project, this specific code chunk implements undeclared baseline management functionality rather than the advertised writing-polish behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language instructions repeatedly frame the skill as producing text for native English-speaking readers and performing 'nativization' to native-level English, but they do not offer any user opt-in or alternative locale/style choice. This is a language-policy constraint expressed in the documentation, and the file does not document it as a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The configuration name explicitly targets an "english-polish" setup, which indicates a fixed language/locale constraint. Under the policy rules, forcing a specific language without offering user choice or documenting a justified regional constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The module docstring defines the tool as an "english-polish" detector for scoring "non-native English text," and the rest of the file is built around judging text against native-English norms. This is a language-policy constraint presented as a fixed behavior rather than an optional or user-selected locale, which can violate policies against forcing a specific language without opt-in.

Content

No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

• Category: YARA Match
• Confidence: 65% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/detector.py (reported line 15)May include surrounding context.

python

:
    python3 detector.py check <file.md>         # Score a single file
    python3 detector.py check <dir/>            # Score all .md files in dir
    python3 detector.py batch <dir/>            # Score + generate report
    python3 detector.py interactive             # Paste text interactively

Pattern Library (18 categories):
    A. Subject Dangling        — "For chip design, competition is fierce..."
    B. Redundant "As For"      — "As for the energy cost, it is..."
    C. Passive Chain Stacking  — "It can be seen that..."
    D. "Make + abstract noun"   — "make a decision" → "decide"
    E. "Not only...but also"    — overused default connector
    F. Noun Stacking (4+consec) — "Data center GPU market growth prediction..."
    G. "Should" false obligation — "China should develop..." when describing fact
    H. "The" overuse for generic — "the computing power is..."
    I. Chinese filler expressions — "to a certain extent", "in the process of"
    J. "This is b

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/polish.py (reported line 394)May include surrounding context.

python

with open("/tmp/polish_new.md", "w") as f:
            f.write(polished)

        result = subprocess.run(
            ["diff", "-u", "/tmp/polish_orig.md", "/tmp/polish_new.md"],
            capture_output=True,
            text=True,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill's stated purpose is English polishing and diff/report generation, but this implementation achieves diffing by spawning the system diff executable via subprocess.run. Launching external commands is a broader capability than expected for a text-polishing skill and is not justified by the manifest description, which mentions CLI scripts and diff output but not shelling out to OS utilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code performs file writes to both the polished output path and a generated report path. While the file header documents outputs, there is no user-facing confirmation or warning immediately before writing, and the operation can overwrite a custom output path supplied by the user.

Content

No source excerpt is available for this finding.

Tainted flow: 'polished_text' from pathlib.Path.read_text (line 477, file read) → pathlib.Path.write_text (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/polish.py (reported line 491)May include surrounding context.

python

else:
        out = path.parent / f"{path.stem}-polished{path.suffix}"

    out.write_text(polished_text, encoding="utf-8")

    # Build report
    report_lines = []

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

• Category: YARA Match
• Confidence: 65% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

# Known Chinglish Test Cases

## Pattern A: Subject Dangling
For chip design, competition is fierce among all players. Regarding the ASIC market, it is growing rapidly.

## Pattern B: Redundant "As For"
As for the energy cost, it is becoming the main constraint. When it comes to data centers, power efficiency matters.

## Pattern C: Passive Chain Stacking
It can be seen that the market is being reshaped by export controls. It should be noted that NVIDIA is being challenged by AMD.

## Pattern D: "Make + abstract noun"
This makes the competition harder to win. We need to make a comparison between two architectures. Let's have a discussion about the impact.

## Pattern E: "Not only...bu

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

• Category: YARA Match
• Confidence: 65% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · tests/known_chinglish.md (reported line 4)May include surrounding context.

md

# Known Chinglish Test Cases

## Pattern A: Subject Dangling
For chip design, competition is fierce among all players. Regarding the ASIC market, it is growing rapidly.

## Pattern B: Redundant "As For"
As for the energy cost, it is becoming the main constraint. When it comes to data centers, power efficiency matters.

## Pattern C: Passive Chain Stacking
It can be seen that the market is being reshaped by export controls. It should be noted that NVIDIA is being challenged by AMD.

## Pattern D: "Make + abstract noun"
This makes the competition harder to win. We need to make a comparison between two architectures. Let's have a discussion about the impact.

## Pattern E: "Not only...bu

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

• Category: YARA Match
• Confidence: 65% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · tests/test_suite.py (reported line 22)May include surrounding context.

python

# Known Chinglish Test Cases

## Pattern A: Subject Dangling
For chip design, competition is fierce among all players. Regarding the ASIC market, it is growing rapidly.

## Pattern B: Redundant "As For"
As for the energy cost, it is becoming the main constraint. When it comes to data centers, power efficiency matters.

## Pattern C: Passive Chain Stacking
It can be seen that the market is being reshaped by export controls. It should be noted that NVIDIA is being challenged by AMD.

## Pattern D: "Make + abstract noun"
This makes the competition harder to win. We need to make a comparison between two architectures. Let's have a discussion about the impact.

## Pattern E: "Not only...bu

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The changelog describes this as the "english-polish skill," which is a natural-language locale constraint. In this file there is no indication that users can choose a different language/locale or that the restriction is explicitly justified as region-specific, so it may violate the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The generated footer says the report was produced by detector.py v..., which implies a version string will be shown. However, the code interpolates Path(__file__).parent.parent.joinpath("VERSION"), which is a path object rather than the file's contents, so the displayed value contradicts the stated intent of showing the tool version.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code writes predictable temporary files to /tmp using fixed names before invoking diff. On multi-user systems, an attacker could pre-create symlinks or race these paths to cause overwrite of unintended files, read sensitive content from world-accessible temp files, or interfere with processing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The module docstring names the skill as an "english-polish" detector, and the test data and descriptions consistently frame acceptable input/output around native English only. This is a natural-language locale preference embedded in the file without any indication of user choice or documented regional justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.