Security audit

Tutur Humanizer

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Indonesian text-editing skill with an optional local phrase scanner; I found no hidden persistence, exfiltration, or privileged behavior.

Install this if you want Indonesian-language rewriting and review. Be aware that when you ask it to edit files, it may directly modify the target text and then summarize changes; review important writing before relying on the result.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose describes an active text transformation/review skill that humanizes or adapts Indonesian prose. The actual code only performs heuristic detection of certain stock phrases and repeated words, then emits a machine-readable report. While this could support an editor reviewing AI-sounding wording, it does not itself rewrite, edit, adapt style, or preserve meaning through transformation as described. Its primary purpose is detection/analysis, not text rewriting. Therefore the behavior is materially different from the declared description.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description constrains the skill to rewriting and reviewing Indonesian text only, which is a language-specific policy choice. Because the file does not present this as a user-selectable option or explicitly justify the locale restriction as region-specific, it reads as a forced language constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The natural-language description and prompt explicitly constrain the skill to Indonesian text, but there is no indication that this language limitation is optional, user-selected, or justified as a region-specific tool. This can violate language/locale policy when a skill imposes a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The default prompt says to use the skill to make 'this Indonesian text sound natural' but does not define when the skill should be invoked, what kinds of text qualify, or any exclusions. In a manifest file, this broad invocation wording can overlap with many ordinary rewriting requests and may cause unintended activation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The markdown explicitly states 'Target language: Bahasa Indonesia.' as a fixed setting. Under the policy, language constraints should offer user choice or clearly justify the restriction; this file presents the locale as mandatory without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document defines Indonesian-specific spelling, lexical, and style rules as the mandatory baseline and states that the skill may directly rewrite Indonesian text across multiple contexts. This is a natural-language locale constraint, but the file does not indicate that users can choose another language or explicitly opt into Indonesian-only behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file instructs the skill to be used for formalizing or stylizing Indonesian text and defines default behavior based on Indonesian trigger phrases, but it does not indicate that users may opt into another language or that the Indonesian-only scope is a documented regional constraint. This is a natural-language locale policy issue because the guidance implicitly enforces a specific language context without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The instruction says to treat EYD V as the default authority for official/formal Indonesian writing. This imposes a specific language/locale standard in natural-language guidance without stating that the skill is limited to Indonesian-language use cases or offering users a choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instruction says to return rewritten Indonesian text directly for plain rewrite requests, which imposes a specific language output by default. SQP-3 applies because the file does not indicate that the user can choose another language or explicitly opt into Indonesian-only behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file instructs the skill to edit a file and then summarize changes, but it does not include any warning or disclosure about altering user files. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data or system integrity.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.