ClawHub
Back to skill

Security audit

OEE Content Humanizer

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Anthropic-backed text rewriting skill, with privacy and output-review caveats but no hidden persistence or destructive behavior.

Install only if you are comfortable sending the text you ask it to rewrite to Anthropic using your ANTHROPIC_API_KEY. Do not use it for secrets, regulated data, or confidential drafts unless that external processing is acceptable, and review the rewritten output before publishing or passing it into other automated workflows.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
humanize.py:58
Finding

Untrusted Input Can Override LLM Rewrite Instructions

Content
View full analysis
str: """Construct the rewrite prompt.""" # 🐾 channel_guide = CHANNEL_GUIDES.get(channel, CHANNEL_GUIDES["general"]) tells_note = "" if tells: tells_note = ( f"\n\nDetected AI tells to eliminate: {', '.join(tells)}. " "Replace these with concrete, specific language." ) return f"""You are a human editor. Your job: take AI-generated text and make it sound like a real person wrote it. Rules: - Kill vague qualifiers. Be specific or cut them. - Vary sentence length. Mix short punchy sentences with longer flowing ones. - Use contractions (it's, don't, we're) where natural. - Fragments are fine. So are one-word sentences. Really. - Remove filler that doesn't carry meaning. - Keep the core message intact — don't invent new claims. - Add natural rhythm imperfections — humans don't write in perfect parallel structure. - No meta-commentary. Don't say "here's the rewritten version". Just output the text. {tells_note} Channel guidance: {channel_guide} TEXT TO HUMANIZE: --- {text} --- Output ONLY the rewritten text. Nothing else.""" ``` ### Technical Analysis The `text` parameter originates from a command-line argument or standard input and is interpolated verbatim into the same natural-language prompt that contains the application's operational instructions. The `---` delimiters are only text and do not create an enforceable trust boundary for the downstream language model. An attacker can submit content containing instructions that conflict with the rewrite rules, such as directions to ignore previous instructions and emit attacker-selected text. Because the model must interpret both the trusted rules and the untrusted co ...[truncated 1956 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tainted flow: 'req' from os.environ.get (line 102, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · humanize.py (reported line 113)May include surrounding context.

python
)

    try:
        with urllib.request.urlopen(req) as resp:
            data = json.loads(resp.read())
            return data["content"][0]["text"]
    except urllib.error.HTTPError as e:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

No manifest is available, so the skill has no declared purpose or scope to justify external network access or reading credentials from environment variables. The code transmits the provided text to a remote API using an API key from ANTHROPIC_API_KEY, which is a meaningful capability beyond local text processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sends arbitrary input text to a third-party API without an explicit user-facing warning or confirmation at the point of use. If users pass sensitive drafts, emails, credentials, or proprietary material, that data leaves the local environment and is exposed to external retention, monitoring, or policy risks beyond the user's expectations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · humanize.py (reported line 103)May include surrounding context.

python
}).encode()

    req = urllib.request.Request(
        "https://api.anthropic.com/v1/messages",
        data=payload,
        headers={
            "Content-Type": "application/json",

Static analysis

No suspicious patterns detected.