ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Ai Humanizer.Disabled

v1.0.0

Humanize AI-generated text by detecting and removing patterns typical of LLM output. Rewrites text to sound natural, specific, and human. Uses 28 pattern det...

⭐ 0· 64·0 current·0 all-time
byRobin.Z@robinzorro86
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name, description, SKILL.md, README, CLI, API server, MCP server, and src/* modules all implement AI-writing detection and humanization logic. Required env/config/credentials are empty and there are no unrelated capabilities (no cloud credentials, no crypto, no system management). The presence of servers and CLI matches the described repo and features.
ℹ
Instruction Scope
SKILL.md and companion instruction files explicitly instruct the agent to analyze and rewrite text and to surface pattern matches and statistics. Those instructions are narrowly scoped to text analysis/humanization. The pre-scan flagged a 'system-prompt-override' pattern because the skill includes explicit role/system-like instructions (e.g., 'You are a writing editor...'); this is expected for a humanizer skill but is a prompt-injection pattern to be aware of if you accept system-level instruction changes.
ℹ
Install Mechanism
The registry lists no automated install spec (instruction-only), but the package includes a full Node.js project (CLI, API server, MCP server) with package.json and scripts. That is coherent (the README documents npm install and running servers), but there is no platform-level install automation declared in the registry metadata — meaning nothing will be auto-downloaded or executed on install. If you run the included code locally, it will start HTTP/stdio servers and should be audited before deployment.
✓
Credentials
No required environment variables, credentials, or config paths are declared. Source references only common variables (e.g., process.env.PORT) and no secrets. The skill does not request unrelated tokens or keys.
✓
Persistence & Privilege
Skill flags show always:false and default model invocation behavior. There is no evidence the skill modifies other skills or agent-wide settings. It offers optional servers and MCP integration but these are standard integrations and require the user to run or configure them.
Scan Findings in Context
[system-prompt-override] expected: The SKILL.md and instruction files contain role/system-style instructions (e.g., 'You are a writing editor…', 'NEVER use these words…'). This is expected for a text-transform tool but triggers a prompt-injection detector. It should be reviewed but is not, by itself, malicious.
Assessment
This skill appears coherent: its files, tests, CLI, API server, and SKILL.md all implement an AI-writing detector/humanizer and it does not request secrets. Before you run or deploy anything: 1) If you run the included Node servers (api-server or mcp-server), review the code (server binds to a port, uses CORS: '*') and do not deploy them to a public host without hardening. 2) The SKILL.md contains strong role-style instructions (normal for this kind of tool) — be aware those instructions may alter assistant behavior while loaded. 3) If you plan to integrate via MCP or run npm scripts, inspect dependencies (mcp-server depends on @modelcontextprotocol/sdk) and run tests locally. 4) Don’t run the code on production machines or expose it publicly until you’ve audited logging, error handling, and any network interfaces. If you want a deeper risk review, provide the contents of src/* (full source was truncated) or indicate whether you'll run the API/MCP servers so I can point out any server-specific risks.
!
docs/INTEGRATIONS.md:123
Prompt-injection style instruction pattern detected.
About static analysis
These patterns were detected by automated regex scanning. They may be normal for skills that integrate with external APIs. Check the VirusTotal and OpenClaw results above for context-aware analysis.

Like a lobster shell, security has layers — review code before you run it.

latestvk977qk39dc00r7ftgw4y1ap6mx83pe1m

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments