ClawHub
Back to skill

Security audit

text-humanization

Security checks for vulnerabilities and agentic risk

Overview

This skill is a transparent text-rewriting helper, with optional examples users should treat carefully when text privacy or authorship disclosure matters.

Install only if you want phrase-based text rewriting. Prefer the local implementation for private drafts, customer data, unpublished work, or business content. Do not use the hosted API example unless you trust the endpoint and understand its payment and data handling. Keep AI authorship disclosures when required.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Natural-Language Policy Violations

Medium
Confidence
87% confidence
Finding
The replacement rules explicitly remove phrases such as 'As an AI language model' and 'I don't have personal opinions,' which can conceal that content was AI-generated or machine-authored. In contexts involving disclosure requirements, compliance, academic integrity, or user trust, this can facilitate deceptive presentation of generated text as human-authored.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest and overview describe a text transformation skill focused on replacing common AI phrases in text. However, the SKILL.md also documents a batch-processing implementation that reads Markdown files from ./content and writes transformed output into ./humanized, which is broader behavior than the stated text-only transformation scope.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill is described as a local text-humanization function, but it also documents sending user text to a remote paid API. That creates an undisclosed data-flow change: potentially sensitive content may leave the local environment and be transmitted to a third party, which is materially different from the stated purpose and trust model.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The paid external API and payment header are not necessary to perform simple phrase replacement, which can be done fully locally as shown elsewhere in the skill. Introducing payment-linked external calls increases privacy, supply-chain, and billing risk without a clear functional need, especially if users assume the skill is offline and self-contained.

External Transmission

Medium
Category
Data Exfiltration
Content
## x402 Pay-Per-Humanize

```bash
curl -X POST https://your-api.com/api/humanize \
  -H "Content-Type: application/json" \
  -H "X-PAYMENT: <base64_payment>" \
  -d '{"text":"In today'\''s digital landscape, it is important to note that we should utilize robust solutions."}'
Confidence
95% confidence
Finding
The documented curl command sends input text and a payment token to an external endpoint, creating a direct exfiltration path for any supplied content. Even though it is presented as an example, users may transmit sensitive drafts, emails, or proprietary content to an unvetted third-party service without realizing the privacy and security implications.

Static analysis

No suspicious patterns detected.