ClawHub
Back to skill

Security audit

Linkedin Humanizer

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent, but its detector-testing path can upload complete drafts to multiple third-party AI detector services by default when API keys are present.

Install only if you are comfortable with an editing skill that aggressively rewrites LinkedIn drafts and with an optional detector script that may send full text to third-party services when API keys are configured. Use audit or demo mode for local-only review, avoid running API mode on confidential drafts, and prefer explicit provider selection and consent before any detector upload.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/test_detectors.py:325
Finding

Default online mode transmits complete user drafts to multiple third-party services without per-run consent

Content
View full analysis
DetectorResult: key = os.getenv("GPTZERO_API_KEY") if not key: return DetectorResult("GPTZero", None, "no API key (set GPTZERO_API_KEY)") try: r = requests.post( "https://api.gptzero.me/v2/predict/text", headers={"x-api-key": key, "Content-Type": "application/json"}, json={"document": text}, timeout=30, ) ``` ```python def detect_originality(text: str) -> DetectorResult: key = os.getenv("ORIGINALITY_API_KEY") if not key: return DetectorResult("Originality.ai", None, "no API key (set ORIGINALITY_API_KEY)") try: r = requests.post( "https://api.originality.ai/api/v1/scan/ai", headers={"X-OAI-API-KEY": key, "Content-Type": "application/json"}, json={"content": text, "title": "detector-test"}, timeout=30, ) ``` ```python def detect_zerogpt(text: str) -> DetectorResult: key = os.getenv("ZEROGPT_API_KEY") if not key: return DetectorResult("ZeroGPT", None, "no API key (set ZEROGPT_API_KEY)") try: r = requests.post( "https://api.zerogpt.com/api/detect/detectText", headers={"ApiKey": key, "Content-Type": "application/json"}, json={"input_text": text}, timeout=30, ) ``` ```python def detect_sapling(text: str) -> DetectorResult: key = os.getenv("SAPLING_API_KEY") if not key: return DetectorResult("Sapling", None, "no API key (set SAPLING_API_KEY)") try: r = requests.post( "https://api.sapling.ai/api/v1/aidetect", json={"key": key, "text": text}, timeout=30, ...[truncated 4228 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
scripts/requirements.txt:1
Finding

Unpinned third-party dependencies create non-reproducible installations

Content
View full analysis
=2.31 python-dotenv>=1.0 ``` The documented installation command is: ```bash pip install -r requirements.txt ``` ### Technical Analysis Both dependencies have only minimum-version constraints. The installation process can therefore select any future release that satisfies those lower bounds. No lockfile or package hashes constrain the exact artifacts installed. This makes installations non-reproducible and allows the effective dependency code to change without any modification to the audited project. A future compromised, malicious, or incompatible release could be installed and imported by the detector script. The package names are legitimate and no typosquatting, dependency confusion, or currently malicious package was identified. The finding concerns preventable future-version and integrity risk rather than evidence that the listed dependencies are presently malicious. ### Attack Path 1. A user follows the documented `pip install -r requirements.txt` instruction. 2. pip queries the configured package index and resolves the newest releases satisfying the lower bounds. 3. A future compromised or otherwise unsafe release is selected. 4. The package is installed into the user's Python environment. 5. `scripts/test_detectors.py` imports and executes that dependency code. Successful exploitation depends on compromise of a permitted package release, package index, or dependency resolution path. The project itself does not directly retrieve and execute arbitrary scripts from an unrelated URL. ### Impact Assessment The privileges available to a compromised dependency are those of the user running pip or executing the detector script. Depending on that env ...[truncated 458 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (43)

Tainted flow: 'key' from os.getenv (line 133, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/test_detectors.py (reported line 62)May include surrounding context.

python
if not key:
        return DetectorResult("GPTZero", None, "no API key (set GPTZERO_API_KEY)")
    try:
        r = requests.post(
            "https://api.gptzero.me/v2/predict/text",
            headers={"x-api-key": key, "Content-Type": "application/json"},
            json={"document": text},

Tainted flow: 'key' from os.getenv (line 133, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/test_detectors.py (reported line 81)May include surrounding context.

python
if not key:
        return DetectorResult("Originality.ai", None, "no API key (set ORIGINALITY_API_KEY)")
    try:
        r = requests.post(
            "https://api.originality.ai/api/v1/scan/ai",
            headers={"X-OAI-API-KEY": key, "Content-Type": "application/json"},
            json={"content": text, "title": "detector-test"},

Tainted flow: 'key' from os.getenv (line 133, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/test_detectors.py (reported line 100)May include surrounding context.

python
if not key:
        return DetectorResult("ZeroGPT", None, "no API key (set ZEROGPT_API_KEY)")
    try:
        r = requests.post(
            "https://api.zerogpt.com/api/detect/detectText",
            headers={"ApiKey": key, "Content-Type": "application/json"},
            json={"input_text": text},

Tainted flow: 'key' from os.getenv (line 133, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/test_detectors.py (reported line 119)May include surrounding context.

python
if not key:
        return DetectorResult("Sapling", None, "no API key (set SAPLING_API_KEY)")
    try:
        r = requests.post(
            "https://api.sapling.ai/api/v1/aidetect",
            json={"key": key, "text": text},
            timeout=30,

Tainted flow: 'email' from os.getenv (line 134, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/test_detectors.py (reported line 142)May include surrounding context.

python
)
    try:
        # Step 1: login -> bearer token
        login = requests.post(
            "https://id.copyleaks.com/v3/account/login/api",
            json={"email": email, "key": key},
            timeout=30,

Vague Triggers

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad and map to ordinary conversation like 'review this draft' or 'is this ready', which can cause the skill to activate in unrelated contexts and apply rewriting or audit behavior the user did not clearly request. In this skill, that risk is amplified by the non-negotiable instruction to always scrub text before shipping, making accidental invocation more likely to alter user content or initiate detector-related workflows without clear consent.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md
Global voice rules: see root `SKILL.md` §Voice rules. Additional skill-specific rules:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md
Global voice rules: see root `SKILL.md` §Voice rules. Additional skill-specific rules:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test_detectors.py (reported line 281)May include surrounding context.

python
if len(scores) < 2:
        print("\nNot enough detectors returned a score to compute spread.")
        print("Add API keys to .env or use --manual mode.")
        return {"spread": None, "verdict": "INSUFFICIENT_DATA"}

    lo, hi = min(scores), max(scores)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill advertises and references code-assisted behavior, including detector scripts, environment-based API keys, file references, and networked detector endpoints, but it declares no explicit tool scope or permission boundaries. That creates an authorization gap where an agent may infer it can access env vars, local files, or external services without user-visible constraints, increasing the risk of secret exposure, unintended network calls, or writes during execution.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/detector-list.md (reported line 23)May include surrounding context.

md
## 1. GPTZero

- **Web**: https://gptzero.me
- **API docs**: https://api.gptzero.me/v2/predict/text
- **Auth**: `x-api-key` header. Free tier: 10k words/month. Paid from $9.99/mo.
- **Returns**: `documents[0].class_probabilities.ai` (0.0-1.0) plus per-sentence breakdown.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
77% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. These lines describe documented bias tied to non-native English writing, which raises a clear language-related risk that should be explicitly framed as a limitation or caution if used operationally.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/detector-list.md (reported line 55)May include surrounding context.

md
## 3. ZeroGPT

- **Web**: https://www.zerogpt.com
- **API docs**: https://api.zerogpt.com/api/detect/detectText
- **Auth**: `ApiKey` header. Free tier: 5 requests/min. Paid plans available.
- **Returns**: `data.fakePercentage` (0-100 integer), `data.isHuman` boolean.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/detector-list.md (reported line 87)May include surrounding context.

md
## 5. Copyleaks

- **Web**: https://copyleaks.com/ai-content-detector
- **API docs**: https://api.copyleaks.com/documentation/v3/writer-detector/submit
- **Auth**: 2-step. POST to `/v3/account/login` with email + key, get bearer token, then POST to `/v2/writer-detector/{scanId}/check`.
- **Returns**: `summary.ai` (0-100), per-paragraph breakdown.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest describes a rewriting/auditing skill with a listed sub-tool for multi-detector spread testing, so calling detector services is within scope. However, this standalone script loads secrets from the environment and optional .env file to authenticate against external services, which is a broader credential-handling capability than the humanizing/audit purpose itself implies.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The duplicated finding again identifies outbound transmission to GPTZero. The security concern remains that user-submitted draft text is sent to a third-party service without strong runtime disclosure, which can expose non-public content.

Content

Scanner excerpt · scripts/test_detectors.py (reported line 62)May include surrounding context.

python
if not key:
        return DetectorResult("GPTZero", None, "no API key (set GPTZERO_API_KEY)")
    try:
        r = requests.post(
            "https://api.gptzero.me/v2/predict/text",
            headers={"x-api-key": key, "Content-Type": "application/json"},
            json={"document": text},

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The duplicated finding again identifies outbound transmission to GPTZero. The security concern remains that user-submitted draft text is sent to a third-party service without strong runtime disclosure, which can expose non-public content.

Content

Scanner excerpt · scripts/test_detectors.py (reported line 62)May include surrounding context.

python
if not key:
        return DetectorResult("GPTZero", None, "no API key (set GPTZERO_API_KEY)")
    try:
        r = requests.post(
            "https://api.gptzero.me/v2/predict/text",
            headers={"x-api-key": key, "Content-Type": "application/json"},
            json={"document": text},

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script transmits text to multiple third-party detector APIs but does not provide an explicit user warning or runtime consent about data sharing. This is dangerous because drafts processed by a 'humanizer' or pre-post audit tool are likely to contain unpublished, identifying, or proprietary content, and users may not realize it is being sent off-device.

Content

No source excerpt is available for this finding.

Tainted flow: 'text' from sys.stdin.read (line 326, user input) → requests.post (network output)

Medium
Category
Data Flow
Confidence
95% confidence
Finding

User-supplied text is transmitted to an external detector API without any explicit consent gate, redaction, or privacy warning at execution time. In this skill context, drafts may contain unpublished professional content, personal information, or confidential business text, so silent forwarding to third parties creates a real data-exposure risk.

Content

Scanner excerpt · scripts/test_detectors.py (reported line 62)May include surrounding context.

python
if not key:
        return DetectorResult("GPTZero", None, "no API key (set GPTZERO_API_KEY)")
    try:
        r = requests.post(
            "https://api.gptzero.me/v2/predict/text",
            headers={"x-api-key": key, "Content-Type": "application/json"},
            json={"document": text},

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The hardcoded GPTZero API endpoint confirms a remote third-party recipient for user text. The issue is not the URL itself but that the tool communicates sensitive content to an outside service in a skill where users may not expect such sharing.

Content

Scanner excerpt · scripts/test_detectors.py (reported line 63)May include surrounding context.

python
return DetectorResult("GPTZero", None, "no API key (set GPTZERO_API_KEY)")
    try:
        r = requests.post(
            "https://api.gptzero.me/v2/predict/text",
            headers={"x-api-key": key, "Content-Type": "application/json"},
            json={"document": text},
            timeout=30,

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This duplicate finding correctly points to external transmission to Originality.ai. The danger is unauthorized or unexpected sharing of sensitive draft text with an outside processor.

Content

Scanner excerpt · scripts/test_detectors.py (reported line 81)May include surrounding context.

python
if not key:
        return DetectorResult("Originality.ai", None, "no API key (set ORIGINALITY_API_KEY)")
    try:
        r = requests.post(
            "https://api.originality.ai/api/v1/scan/ai",
            headers={"X-OAI-API-KEY": key, "Content-Type": "application/json"},
            json={"content": text, "title": "detector-test"},

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This duplicate finding correctly points to external transmission to Originality.ai. The danger is unauthorized or unexpected sharing of sensitive draft text with an outside processor.

Content

Scanner excerpt · scripts/test_detectors.py (reported line 81)May include surrounding context.

python
if not key:
        return DetectorResult("Originality.ai", None, "no API key (set ORIGINALITY_API_KEY)")
    try:
        r = requests.post(
            "https://api.originality.ai/api/v1/scan/ai",
            headers={"X-OAI-API-KEY": key, "Content-Type": "application/json"},
            json={"content": text, "title": "detector-test"},

Tainted flow: 'text' from sys.stdin.read (line 326, user input) → requests.post (network output)

Medium
Category
Data Flow
Confidence
95% confidence
Finding

The script uploads arbitrary input text to Originality.ai, which can expose sensitive or proprietary content to a third party. Because this skill is marketed for rewriting and auditing real drafts before posting, the likelihood of users pasting non-public content is high, making the external transmission materially risky.

Content

Scanner excerpt · scripts/test_detectors.py (reported line 81)May include surrounding context.

python
if not key:
        return DetectorResult("Originality.ai", None, "no API key (set ORIGINALITY_API_KEY)")
    try:
        r = requests.post(
            "https://api.originality.ai/api/v1/scan/ai",
            headers={"X-OAI-API-KEY": key, "Content-Type": "application/json"},
            json={"content": text, "title": "detector-test"},

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The Originality.ai endpoint indicates an external destination for submitted content, which can expose drafts and other sensitive text. This is especially relevant in a LinkedIn-post workflow where the material may be pre-publication and proprietary.

Content

Scanner excerpt · scripts/test_detectors.py (reported line 82)May include surrounding context.

python
return DetectorResult("Originality.ai", None, "no API key (set ORIGINALITY_API_KEY)")
    try:
        r = requests.post(
            "https://api.originality.ai/api/v1/scan/ai",
            headers={"X-OAI-API-KEY": key, "Content-Type": "application/json"},
            json={"content": text, "title": "detector-test"},
            timeout=30,

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This duplicate finding identifies the same outbound upload to ZeroGPT. The actual issue is privacy and data-governance exposure from sending user text externally, not code execution or injection.

Content

Scanner excerpt · scripts/test_detectors.py (reported line 100)May include surrounding context.

python
if not key:
        return DetectorResult("ZeroGPT", None, "no API key (set ZEROGPT_API_KEY)")
    try:
        r = requests.post(
            "https://api.zerogpt.com/api/detect/detectText",
            headers={"ApiKey": key, "Content-Type": "application/json"},
            json={"input_text": text},