T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:528- Finding
Uncontrolled Full-Document Disclosure to Third-Party Services
- Content
View full analysis
- Remediation
View remediation
Security audit
Remove the AI flavor
Security checks for vulnerabilities and agentic risk
Overview
This writing skill is mostly a document editor, but it includes clear instructions for bypassing AI detectors, uploading full documents to third-party services, and making invented examples look research-based.
Review carefully before installing. This skill has no apparent malware-like code or persistence, but it is designed around hiding AI authorship signals and includes unsafe editing guidance. Do not use it for academic submissions, compliance-controlled writing, confidential documents, or any text where authorship, source accuracy, or data privacy matters.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Warning
- Location
SKILL.md:502- Finding
Fabrication of Data or Cases to Simulate Research Support
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)
Natural-Language Policy Violations
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The core description says the skill removes AI writing traces and makes output appear human-authored. That is a direct evasion objective: concealing model origin rather than improving content quality, which can be used for academic cheating, policy circumvention, fraud, or deceptive attribution.
- Content
Natural-Language Policy Violations
Critical
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The workflow gives explicit operational steps, tools, and target thresholds for evading AI-content detection systems. This is actionable circumvention guidance that lowers barriers to misuse and makes the skill materially more dangerous than a generic rewriting aid.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list is broad enough to activate on ordinary writing requests such as '润色' or '改写', causing the skill's risky detector-evasion behavior to be applied in many benign contexts. This increases accidental misuse and makes unsafe behavior harder to contain.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill suggests adding 'specific data or case studies' and even allows hypothetical examples to make text appear research-based. This encourages fabrication of supporting evidence, which can mislead readers, falsify academic or professional work, and materially increase deception.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The workflow explicitly instructs users to reduce measured 'AI rate' and recommends external rewriting/detection-evasion tools. That goes beyond benign style editing and directly facilitates evasion of academic or platform integrity controls, enabling misrepresentation of authorship.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The phrase "Or invoke directly when editing documents" does not specify how invocation occurs, what exact trigger phrases or UI actions are supported, or when the skill should not activate. This ambiguity can cause unintended invocation because ordinary document-editing activity is a very broad context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The description defines activation conditions using vague requests like making text 'more human' or 'natural,' without clear safety boundaries. In the context of the rest of the skill, that ambiguity broadens access to functionality that can conceal AI origin and support deceptive use cases.
- Content
Ssd 2
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This section provides platform-specific prompts and rewriting tactics tailored to make generated text look less machine-produced and more human-written. In aggregate, these are not neutral style suggestions but a structured playbook for AI-content detection evasion and provenance masking.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The README gives a single example, "Please humanize this text," but does not define the full trigger set, required context, or exclusions. Without explicit scope or negative examples, users and orchestrators may interpret many loosely related requests as valid triggers.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill name is presented only in Chinese ("去AI味"), which implies a fixed language/locale context without any visible indication of user choice or opt-in. Under the natural-language policy check, locale- or language-specific presentation can be a policy concern when the file does not document that the skill is region-specific or optional by language.
- Content
Static analysis
No suspicious patterns detected.