humanizer-academic

• Outcome: Pass
• Latest audit: Sep 28, 2026 · 3:04 AM UTC
• Version: 4.1.1

Overview

This is a disclosed academic text-rewriting skill with a local diagnostic script, not a hidden persistence or data-stealing tool.

Install only if you are comfortable with a rewriting skill that can read and edit provided drafts, run its bundled detector with Bash, and use a subagent judge for quality checks. For confidential, unpublished, or institutionally restricted writing, disable or avoid the blind-judge step unless you understand where that subagent runs. Prefer a pinned install source instead of the unpinned README npx command.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose says the skill rewrites serious nonfiction to read human, abstaining when already human-like. But the supplied code chunk explicitly states it 'DETECTS only' and 'never rewrites,' and the implementation confirms that: it tokenizes text, detects language/mode, scans heuristic lexical and structural patterns, computes statistical measures, normalizes counts, and outputs a diagnostic JSON verdict. While the detector may support a broader rewrite workflow, this code chunk’s actual primary purpose is measurement/classification, not rewriting. No suspicious permissions or external resource access are present, but the core functionality materially differs from the declared description.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/academic-pack.md (reported line 46)May include surrounding context.

md

### MANDATORY quota move (not advisory): contrast-frame compression

<!-- model_baseline: claude-opus-5-5 / effort high / Claude Code 2.1.280 / 2026-09-25; settled S2 kept; residences: SKILL.md Step 2+5, lexical-en §7b, lexical-zh §2, structural-signals A6 (change together) -->

"不是……而是……/并非……而是……/这不仅是……更是……/X 的本质是……/真正的 X 是……" and
EN "not just X, but Y" / "It's not X. It's Y." / "less about X than Y" —

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.en.md (reported line 3)May include surrounding context.

md

# humanizer-academic

> Rewrite serious nonfiction (academic or serious popular science) to strip AI-writing signals — while keeping its register and never inventing facts.

**English** · [简体中文](README.md)

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.en.md (reported line 23)May include surrounding context.

md

**When to use** — a thesis chapter / abstract / literature review / research or policy report reads templated or AI-generated and you want it human but still academic; or call `/humanizer-academic`.
**Not for** — discriminate three adjacent false-triggers: (1) a CASUAL general humanizer — this one **preserves register** and won't make prose chatty; (2) poetry / speech / fiction dialogue — they legitimately use parallelism and repetition, so **don't flatten them**; (3) detect vs rewrite — the script only emits a signal map, so a "just score this, don't rewrite" request returns the detector map and performs no rewrite. Also not for inventing evidence / citations / numbers, or non-academic casual text.

**Install** — `npx skills add VincentJiang06/skills` (or `cp -R skills/humanizer-academic ~/.claude/skills/`).

Full spec: [SKILL.md](SKILL.md)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to install the skill via npx skills add VincentJiang06/skills without pinning a specific version, commit, or immutable artifact. That creates a supply-chain risk: a later upstream change, account compromise, or malicious package update could cause users to fetch different code than the reviewed version.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 23)May include surrounding context.

md

**什么时候用** —— 论文章节 / 摘要 / 文献综述 / 研究或政策报告读起来像模板、像 AI 生成，想把它改得像人写、但仍是学术文；也可用 `/humanizer-academic` 显式调用。
**不适用** —— 三个相邻的「假触发」要区分：(1) 口语化的通用 humanizer —— 本 skill **保留学术腔**、不把文字改聊天化；(2) 诗歌 / 演讲 / 小说对白 —— 它们本就该用排比与重复，**别压平**；(3) 只检测、不改写 —— 脚本本身只产出信号图，「只打分别改」的请求只返回检测结果、不做重写。也不用于编造证据 / 引用 / 数字，或非学术的随意文本。

**安装** —— `npx skills add VincentJiang06/skills`（或 `cp -R skills/humanizer-academic ~/.claude/skills/`）。

完整说明见 [SKILL.md](SKILL.md)。

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 23)May include surrounding context.

md

**什么时候用** —— 论文章节 / 摘要 / 文献综述 / 研究或政策报告读起来像模板、像 AI 生成,想把它改得像人写、但仍是学术文;也可用 `/humanizer-academic` 显式调用。
**不适用** —— 三个相邻的「假触发」要区分:(1) 口语化的通用 humanizer —— 本 skill **保留学术腔**、不把文字改聊天化;(2) 诗歌 / 演讲 / 小说对白 —— 它们本就该用排比与重复,**别压平**;(3) 只检测、不改写 —— 脚本本身只产出信号图,「只打分别改」的请求只返回检测结果、不做重写。也不用于编造证据 / 引用 / 数字,或非学术的随意文本。

**安装** —— `npx skills add VincentJiang06/skills`(或 `cp -R skills/humanizer-academic ~/.claude/skills/`)。

完整说明见 [SKILL.md](SKILL.md)。

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file is titled "English Patterns" and states that it is the lexical catalogue for English, which imposes a language-specific constraint. Under the policy, language restrictions should either offer user opt-in/choice or be clearly justified as region- or locale-specific; this file does not provide such opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

SQP-3 applies to all file types and flags language-policy issues when a skill forces a specific language without user opt-in. This file presents all guidance exclusively in Chinese and does not state that the skill is region-specific or otherwise intentionally limited to Chinese-speaking users.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a skill whose purpose is to rewrite AI-generated serious nonfiction to read human, with abstain-first behavior. This file does not rewrite or transform text at all; it analyzes text, assigns lexical/structural/statistical signals, and returns a verdict and abstain recommendation, which is a semantically different behavior from the manifest's claimed operation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring explicitly states that it "must never be described as a 'humanizer'" and that it only detects signals, while the enclosing skill manifest describes the skill as a rewriting humanizer. That is an active contradiction between the code documentation and the skill's stated identity and purpose, not merely an omitted detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The module documentation states that detect_signals returns language as only en | zh, and the CLI later enforces --language choices of only en, zh, or auto. This is a natural-language locale constraint embedded in the skill behavior, and the file does not present it as a user opt-in choice or justify it as a narrowly scoped region-specific tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The README presents the English version as the operative document and describes the skill as handling multiple input languages, but this file itself does not offer a user choice about output language or locale behavior. Because language/locale policy violations apply to all file types, this is a mild policy concern based on the explicit language framing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 61% confidence

Finding

The comments and behavior state that uncertain cases should default to academic because it is the 'safer, stricter floor'. This hard-coded preference imposes a mode policy on users in ambiguous cases rather than clearly requiring user selection or documenting consent for that stricter interpretation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.