deaiify

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:21 AM UTC
• Version: 3.4.1

Overview

The skill does what it says: it rewrites assistant replies to remove en dashes and em dashes, with no evidence of hidden exfiltration, destructive behavior, or persistence.

Install this only if you want assistant replies automatically rewritten to remove en dashes and em dashes. Avoid using it in contexts where even assistant output text should not be resent through an embedded model run, and prefer an updated release once the publisher refreshes the dev dependency lockfile.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Known Vulnerable Dependency: vitest==1.6.1 — 1 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed)

Critical

• Category: Supply Chain
• Confidence: 91% confidence

Finding

Vitest 1.6.1 is flagged for arbitrary file read and execution when the Vitest UI server is listening. Although this is a dev dependency rather than application runtime code, a vulnerable test UI exposed on a developer machine or CI environment could enable serious compromise of local files or code execution.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vitest==1.6.1 — 1 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed)

Critical

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The package resolves to a Vitest version with a critical advisory allowing arbitrary file read and execution when the Vitest UI server is listening. Even though Vitest is a dev dependency, this can be dangerous in developer workstations or CI environments if the UI server is used, potentially exposing secrets or enabling code execution.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description claims the skill rewrites text via an embedded LLM to remove banned dash characters before delivery. However, this code chunk only contains unit tests for detecting em-dashes/en-dashes and stripping code blocks before detection. That is related to dash banning, but it does not implement the declared rewrite behavior or any LLM-based transformation. Therefore the actual behavior represented by this chunk materially differs from the declared purpose.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The lockfile includes nanoid 3.3.11, which is flagged for multiple denial-of-service and integer handling issues. Even though it is transitive through PostCSS/Vite and likely used in build tooling, vulnerable utility libraries in the toolchain can still be triggered during development, CI, or processing of attacker-influenced inputs.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.10 — 3 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-73646 (PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) l)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

PostCSS 8.5.10 is present and is associated with arbitrary file read and path traversal class issues involving source map handling. Because PostCSS processes content and metadata during builds, this becomes more dangerous if the skill or its build pipeline ever handles untrusted CSS or attacker-controlled source map references in CI or development environments.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==5.4.21 — 3 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-53632 (launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows)

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

Vite 5.4.21 is flagged for path traversal and Windows-specific filesystem or UNC-path issues. In this repository it is a development dependency, so exploitation is mostly limited to developers, CI runners, or systems where the Vite server or related tooling is exposed, but that still presents meaningful risk in shared or enterprise environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The plugin sends the full outbound reply text to an embedded LLM for rewriting without any explicit user notice or consent in this file. Even though the feature is intentional and tools are disabled, this still creates a data-handling/privacy risk because potentially sensitive model output is retransmitted to another model execution path and may be persisted in temporary session artifacts or provider logs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest description says the skill will "Ban LLM em-dashes and en-dashes before delivery," which enforces a specific language/style constraint by default. This is a natural-language policy concern because it applies a mandatory output convention without indicating user choice or opt-in.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: esbuild==0.21.5 — 1 advisory(ies): GHSA-67mh-4wv8-2f99 (esbuild enables any website to send any requests to the development server and r)

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The lockfile pins esbuild 0.21.5, which is associated with a dev-server request exposure advisory. In this skill context, esbuild appears only as a transitive development dependency via Vite/Vitest, so the issue is real but primarily relevant during local development or testing rather than at runtime for end users.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 70% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json

"stage-package": "node ./scripts/stage-package.mjs"
  },
  "peerDependencies": {
    "@openclaw/plugin-sdk": "*"
  },
  "devDependencies": {
    "@openclaw/plugin-sdk": "file:/opt/homebrew/lib/node_modules/openclaw/dist/plugin-sdk",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 18)May include surrounding context.

json

},
  "devDependencies": {
    "@openclaw/plugin-sdk": "file:/opt/homebrew/lib/node_modules/openclaw/dist/plugin-sdk",
    "@types/node": "^20.10.0",
    "typescript": "^5.3.0",
    "vitest": "^1.0.0"
  },

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 19)May include surrounding context.

json

"devDependencies": {
    "@openclaw/plugin-sdk": "file:/opt/homebrew/lib/node_modules/openclaw/dist/plugin-sdk",
    "@types/node": "^20.10.0",
    "typescript": "^5.3.0",
    "vitest": "^1.0.0"
  },
  "openclaw": {

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 20)May include surrounding context.

json

"@openclaw/plugin-sdk": "file:/opt/homebrew/lib/node_modules/openclaw/dist/plugin-sdk",
    "@types/node": "^20.10.0",
    "typescript": "^5.3.0",
    "vitest": "^1.0.0"
  },
  "openclaw": {
    "plugin": true,

Static analysis

No suspicious patterns detected.