T08 · Insecure Dependencies
- Location
SKILL.md:101- Finding
Unpinned and Unverified Humanizer Skill Invocation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 101-106
Vulnerability Type: Unverified inter-skill dependency
Risk Level: MediumVulnerable instruction:
markdown ### Step 6b: Humanize Invoke a humanizer skill (e.g. "humanize", "humanizer", "de-slop", "natural writing check", "AI detection cleanup", "rewrite like a human") to remove AI-generated patterns — inflated language, predictable sentence rhythm, hollow transitions. Journalists spot AI copy immediately and discard it. **Preserve the headline and lead.** The headline (Step 4) and lead paragraph (5W1H in 25-35 words) were deliberately crafted for news impact. Instruct the humanizer to leave them intact — loosening them for "naturalness" breaks the inverted pyramid and the word-count constraint.Technical Analysis
The skill requires the agent to invoke another skill using several generic names, but it does not identify a trusted provider, immutable version, package hash, or verified local path. This creates an ambiguous dependency-resolution boundary: whichever installed or discoverable component matches a suggested name may receive the generated press release and execute instructions within the current agent session.
A malicious, compromised, or name-colliding humanizer skill could return instruction-hijacking content, alter facts in the release, extract supplied embargoed or personal information, or induce additional tool calls. The risk is amplified because
SKILL.mdline 13 permits theAgenttool, which can enable delegation to another agent or skill implementation.No malicious humanizer implementation, remote payload, installation command, executable script, persistence mechanism, or confirmed data-exfiltration endpoint is present in this repository. The finding concerns unsafe and unpinned trust in an external inter-skill dependency.
Attack Path
- An attacker publishes or installs a component under a generic suggested ...[truncated 1826 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the mandatory external humanizer invocation and perform the style review directly within the current skill whenever possible.
- If delegation is necessary, identify one explicitly trusted dependency using an exact package or skill identifier, trusted publisher, immutable version, and integrity hash.
- Do not resolve dependencies from generic aliases such as
humanizer,humanize, orde-slop. - Require explicit user approval before sending confidential, embargoed, security-related, financial, or personally identifiable information to another skill.
- Pass only the minimum required text. Redact media contacts, private URLs, credentials, unpublished figures, and unnecessary source documents.
- Run the delegated skill in a restricted context with no network, file-write, shell, memory, or additional agent permissions unless each capability is specifically required.
- Treat delegated output strictly as untrusted data. Do not execute embedded instructions or tool requests, and validate that facts, quotations, figures, headline, and lead remain unchanged.
- Maintain an allowlist of reviewed inter-skill dependencies and fail closed when the approved implementation is unavailable.
- Record the resolved dependency identity and version in audit logs so substitutions can be detected.