Humanizer Zh Cn

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:48 PM UTC
• Version: 1.0.0

Overview

This is a disclosed Chinese text-editing skill for making AI-styled writing sound more natural, with no hidden execution, exfiltration, or persistence behavior found.

Install from a reviewed commit or release where possible, and avoid running the npx installer with elevated privileges. Use the skill when you explicitly want text rewritten for a more natural voice, and review edits carefully so meaning, attribution, and language are preserved.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:24

Finding

Unpinned Third-Party Installer Execution

Content

View full analysis

Vulnerability Details

File Location: README.md, line 24
Vulnerability Type: Unpinned third-party package and mutable remote source
Risk Level: Medium

Vulnerable Code

bash

npx skills add https://github.com/op7418/Humanizer-zh.git

Technical Analysis

The recommended installation command uses npx to obtain and execute the skills npm package without specifying a reviewed version or integrity hash. Depending on the local environment and cache state, npx may download the current package release and execute its code with the user's privileges.

The Git repository supplied to that installer is also referenced without a commit hash or immutable release identifier. Both executable installer behavior and installed Skill content can therefore change after this project has been reviewed. The implementation of the skills package and the remote repository content are not included in the audited artifact, so their behavior cannot be verified by this audit.

This is a supply-chain weakness rather than evidence that either external source is currently malicious.

Attack Path

1. An attacker compromises, replaces, or maliciously updates the unpinned skills npm package, or gains control of the referenced Git repository.
2. The attacker publishes code or Skill content containing an unwanted payload.
3. A user follows the recommended npx skills add command.
4. npx retrieves and executes the mutable installer package with the user's permissions.
5. The installer may execute arbitrary local operations or install attacker-controlled Skill instructions.
6. The resulting impact persists to the extent that modified files or malicious Skill content remain installed.

Impact Assessment

Successful exploitation through the npm installer could permit arbitrary code execution with the privileges of the user running npx. This could expose files and credentials accessible to that account, modify local development configuration, or instal ...[truncated 399 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm installer to a reviewed, exact version:

   bash

   npx --yes skills@<reviewed-version> add <immutable-source>
   

2. Reference a reviewed Git commit rather than a mutable default branch.

3. Publish and verify checksums or cryptographic signatures for release artifacts.

4. Document the expected installer behavior and the files it creates or modifies.

5. Prefer manual installation from a reviewed release archive when practical.

6. Advise users to inspect the package and remote Skill contents before installation, especially when running the command in an account with access to sensitive files.

7. Avoid running the installer with administrator or root privileges.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to execute npx skills add https://github.com/op7418/Humanizer-zh.git without pinning a specific version, commit, or release. This causes users to fetch and run whatever code the current skills package and remote repository resolve to at install time, creating a supply-chain risk if either upstream artifact is compromised or changes unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill is defined entirely in Chinese and does not instruct the agent to preserve or negotiate the user's language, which can lead to unintended language switching. In mixed-language environments, this may cause data handling mistakes, user confusion, or silent transformation of content into the wrong language during editing tasks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger '编辑或审阅文本，去除 AI 写作痕迹' is broad enough to match many ordinary editing or review requests, so the skill may activate in contexts the user did not specifically intend. That can cause unexpected rewriting of user content, override a more appropriate skill, or nudge outputs toward concealment of AI origin without explicit consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.