ai-humanizer

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:37 AM UTC
• Version: 2.1.0

Overview

This skill is a transparent writing-analysis and humanization tool with no hidden data access or automatic file changes, though its AI-detection labels and always-on style advice should be used carefully.

Install this as an on-demand writing helper, not as an authority on whether someone used AI. Review any humanized or auto-fixed output before using it, especially where meaning, authorship, citations, academic integrity, or compliance matters. Only add the always-on prompt templates to a dedicated writing agent or with explicit user consent, because they persistently change the agent's style across tasks.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear material mismatch. The description presents a natural-language processing skill for detecting and rewriting AI-generated text, including pattern detectors, vocabulary tiers, and statistical metrics. The actual code chunk contains only ESLint configuration for JavaScript files, defining recommended linting settings, environments, globals, and ignore rules. It does not process text, analyze writing, detect AI patterns, or rewrite content. Its primary purpose is unrelated development tooling configuration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The description claims a dual-purpose skill: detect AI-style patterns and rewrite text to sound human. In the provided code, the tested functionality centers on analyze(), score(), and formatting/reporting functions, along with many pattern detectors and statistical measures. That aligns well with the detection/scoring portion of the description, including pattern categories and stats like burstiness and type-token ratio. However, there is no evidence in this code chunk of any rewriting, de-AI transformation, or text humanization behavior. Because the declared purpose prominently includes rewriting/humanizing text, while the actual supplied code chunk only demonstrates analysis and reporting, this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a full text analysis and rewriting capability focused on detecting and humanizing AI-generated writing. The actual code chunk does not implement any text processing, detection, scoring, or rewriting logic. It is solely a test framework configuration file for Vitest, specifying globals and test file inclusion patterns. This is a materially different primary purpose, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

echo "Your text here" | node src/cli.js score

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

echo "Your text here" | node src/cli.js score

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md

echo "Your text here" | node src/cli.js score

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

echo "Your text here" | node src/cli.js score

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md

echo "Your text here" | node src/cli.js score

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md

echo "Your text here" | node src/cli.js score

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md

echo "Your text here" | node src/cli.js score

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README promotes humanize --autofix as a normal workflow but does not clearly warn that it can modify text content and potentially overwrite or alter user files. In an agent skill context, mutation features are more sensitive because users may invoke them through automation and may not realize content will be changed rather than only analyzed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README instructs users to bake the skill into an agent's always-on personality, including hard bans on words and enforced stylistic behavior without user-specific opt-in. In an agent environment, this can silently override user intent, degrade transparency, and cause broad prompt-level behavior manipulation beyond the narrow task of text review or humanization.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The invocation text is broad enough to trigger on many ordinary writing-improvement requests, which can cause the skill to activate outside the user's actual intent. In an agent setting, overbroad activation can silently rewrite outputs, alter tone or meaning, and override higher-priority task requirements without explicit consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The 'Always-on mode' guidance instructs agents to internalize this skill's style rules globally, regardless of user request or context. That is dangerous because it can create persistent behavior hijacking: the agent may suppress valid phrasing, alter outputs in unrelated domains, and follow the skill's policy over the user's instructions or task-specific requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

These instructions impose a mandatory writing-style policy without user opt-in, directing the agent to ban words and patterns across interactions. In practice, that can manipulate model behavior, reduce fidelity to user requests, and interfere with legitimate tasks that need formal, neutral, repetitive, or domain-specific wording.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The analyzer generates definitive-sounding classifications such as 'heavily AI-generated' and 'The text looks human-written' without surfacing uncertainty, error rates, or false-positive caveats. In a skill explicitly designed to detect and humanize AI text, users may over-trust these outputs and make moderation, academic, hiring, or compliance decisions based on probabilistic heuristics presented as fact.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The style tip explicitly recommends adding first-person phrases such as "I found" and "In my experience" regardless of whether the author actually has that experience. In a skill designed to humanize AI text, this can induce users or downstream agents to fabricate personal experience or observations, which is a deceptive content-generation behavior rather than a neutral style edit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The file explicitly implements an "English heuristic" for syllable counting, while the module-level comments present the engine more generally as computing statistics that distinguish AI from human writing. This creates a natural-language locale constraint that is not paired with user opt-in or clear justification for non-English text handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file hard-codes English-language vocabulary and phrase heuristics as signals of 'AI-generated' writing without any visible locale gating, consent, or qualification. In a humanization skill, this can pressure outputs toward a narrow English-centric style and misclassify legitimate dialects, ESL writing, or domain-specific prose, creating biased transformations and unsafe quality decisions.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 41)May include surrounding context.

json

"url": "https://github.com/brandonwise/humanizer"
  },
  "devDependencies": {
    "@eslint/js": "^9.39.2",
    "eslint": "^9.0.0",
    "prettier": "^3.0.0",
    "vitest": "^3.0.0"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 42)May include surrounding context.

json

},
  "devDependencies": {
    "@eslint/js": "^9.39.2",
    "eslint": "^9.0.0",
    "prettier": "^3.0.0",
    "vitest": "^3.0.0"
  },

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 43)May include surrounding context.

json

"devDependencies": {
    "@eslint/js": "^9.39.2",
    "eslint": "^9.0.0",
    "prettier": "^3.0.0",
    "vitest": "^3.0.0"
  },
  "engines": {

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 44)May include surrounding context.

json

"@eslint/js": "^9.39.2",
    "eslint": "^9.0.0",
    "prettier": "^3.0.0",
    "vitest": "^3.0.0"
  },
  "engines": {
    "node": ">=18.0.0"

Unverifiable Dependency: vitest has 3 known advisory(ies) (CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock); CVE-2025-24964 (Vitest allows Remote Code Execution when accessing a malicious website while Vit)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.