Advanced Human Writing & AI Humanizer

• Outcome: Review
• Latest audit: Sep 29, 2026 · 12:25 PM UTC
• Version: 0.15.3

Overview

This is a disclosed local writing and audit toolkit; the main risks are broad activation and optional local MCP/file coordination, not hidden or malicious behavior.

Install only if you want a broad writing-assistant skill with local file access for drafts and audit outputs. For the MCP server, set --root to a narrow project folder, keep HTTP on loopback unless you use a strong bearer token behind HTTPS, and review generated fixes or audit reports before applying them to important documents.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (52)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · README.md (reported line 292)May include surrounding context.

human-writing-skills verify --source original.md --candidate revised.md

text

You can also run directly from the source checkout with `python -m humanwriting.cli ...`. The `build` and `humanize` commands print instruction packs that can be pasted into Codex, ChatGPT, Claude, local LLM tools, or another writing agent.

## Quick Humanize

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear mismatch because the declared description claims a feature-rich writing and auditing skill, while the supplied code chunk contains only module metadata in init.py. No functional logic is present to support any of the declared capabilities, triggers, or behaviors. Based on this chunk alone, the actual purpose is package/version definition, which is materially different from the declared end-user functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents an end-user writing assistant/humanizer/editor for rewriting, fiction continuation, proofreading, continuity checking, style and dialogue audits, and translationese review. The supplied code does not perform any of those user-facing editing or review tasks directly. Instead, it is an internal evaluation module that loads benchmark cases, validates schema fields, runs two specific model functions (serious-document detection and fidelity comparison), aggregates metrics, and outputs an evaluation report. While 'semantic rewrite-fidelity triage' loosely overlaps with fidelity as a concept, the primary purpose here is benchmarking those functions, not providing the broad writing-humanization and fiction-editing capabilities claimed. This is therefore a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code does not perform the broad authoring, editing, humanization, continuation, or continuity-review functions claimed in the description. Its primary function is much narrower: verifying whether a rewritten candidate preserves fidelity to a source text by comparing protected literals and flagging changed claims for manual review. This does align with one small slice of the description ('semantic rewrite-fidelity triage'), but the declared purpose overwhelmingly presents a comprehensive multilingual writing and fiction-audit tool, which the supplied code does not implement. There are no suspicious external resource accesses or undeclared permissions, but the description materially overstates and misrepresents the skill’s actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description promises an expansive AI writing and fiction-audit system with advanced multilingual rewriting, continuity checking, long-context/book review, translation fidelity analysis, and character/dialogue consistency auditing. The supplied code does not implement any of those higher-level behaviors. Instead, it performs conservative mechanical edits using a fixed list of regex replacements and deletions, then formats a report and optionally writes the candidate text to a file. While this could loosely support a tiny subset of 'de-AI writing' cleanup, the actual primary purpose is a simple deterministic prose cleanup tool, which is materially narrower and different from the declared skill scope. Additionally, the code reads and may write local files despite no declared permissions being listed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied code chunk has a much narrower purpose than the description. It does not perform text humanization, rewriting, editing, continuation, proofreading, translation review, or broad stylistic/semantic audits. Instead, it compiles a prompt specifically for continuity-ledger extraction from manuscript text, emphasizing evidence-backed canon tracking, state transitions, contradictions, and unknowns. While this partially overlaps with the declared continuity-audit theme, the primary behavior is a specialized ledger-extraction utility, and it explicitly instructs not to continue, rewrite, or improve prose. Therefore the declared description materially overstates and misrepresents this code chunk’s actual function.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad, advanced editing and rewriting system for multilingual prose and fiction, including humanization, proofreading, continuation, continuity auditing, translation-fidelity review, and long-form/whole-book analysis. The supplied code instead defines a rule-based linter: it detects regex-based patterns such as inflated vocabulary, generic openings/closings, chatbot artifacts, formulaic contrast, narrative heading issues, repeated scene recipes, dialogue-response gaps, and related style heuristics. It computes scores/confidence and formats reports. While this partially overlaps with 'AI writing cleanup' and some stylistic auditing, the implemented scope is far narrower and materially different from the declared primary purpose. The code analyzes text for writing-pattern warnings; it does not rewrite, edit, continue, or semantically verify content. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents an expansive end-user writing assistant for humanizing AI text, editing fiction, auditing continuity, and performing multilingual long-form review. The supplied code chunk does not implement those interactive or editorial behaviors. Instead, it is a narrow pre-commit/CLI wrapper around a linter: it parses file paths and options, runs lint_file on each existing file, prints formatted lint reports, and returns a failing exit code when the score exceeds a threshold. That is a materially different primary purpose from a humanizer or story-review assistant. While a writing-pattern linter may support a broader writing tool, this chunk itself is specifically automation/infrastructure for repository checks, which is not represented in the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code does not implement text humanization, fiction editing, style matching, story continuation, character consistency analysis, dialogue auditing, or semantic rewrite-fidelity review as described. Instead, it focuses on safeguarding factual/literal elements in rewrites: detecting whether content is a serious document, extracting protected items, comparing source versus candidate for missing/added protected tokens, reading files, and producing manifests/reports. While this could be a supporting component inside a larger rewriting system, the supplied chunk’s actual primary purpose is preservation/verification of protected content, which is a materially different capability set from the declared end-user writing assistant functions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a feature-rich writing and auditing skill that performs substantive natural-language transformation and review tasks. The supplied code does none of that. Instead, it is infrastructure code for locating and loading markdown-based skill definitions from a skills directory or package resource, classifying some names as style skills, and returning their contents. This is a materially different primary purpose from the declared behavior. While file loading could support the broader system, this chunk itself only manages skill metadata/content retrieval, which is not accurately represented by the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code chunk does not implement the declared writing-humanization and fiction-audit behavior. Instead, its primary function is to ingest local text files, sample their contents under a character budget, and produce a formatted block instructing downstream use as factual sources. This is a materially different purpose from natural rewriting, style matching, continuity checking, dialogue audit, or translationese review. The file-system access and source-grounding behavior are undeclared in the description, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a large-feature writing tool focused on rewriting text to sound more human, editing fiction, reviewing continuity and character consistency, translationese analysis, and long-form/book-level auditing. The supplied code does not perform any of those substantive tasks. Instead, it is a narrow analytics component that computes surface-level style statistics and emits warnings based on thresholds, with an explicit disclaimer that the metrics are only editing diagnostics. While some metrics could support a broader writing-review system, this code chunk by itself mainly provides statistical analysis of text structure and language markers. That is a materially different primary purpose from the declared assistant behavior, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description focuses on text rewriting, proofreading, fiction auditing, and multilingual AI-humanization capabilities. The actual code chunk does not implement any text analysis, rewriting, stylistic editing, continuity checking, or language-processing behavior. Instead, it is an infrastructure utility for assembling a distributable SkillHub package from repository files. This is a materially different primary purpose from the declared end-user writing assistant functionality, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents an end-user writing assistant focused on humanizing AI text, editing fiction, auditing continuity, and reviewing style/translation quality. The supplied code does not implement any of those user-facing text transformation or auditing capabilities. Instead, it is a test file that checks whether an evaluation function and CLI produce expected benchmark statistics and validation errors. While this may support a larger package related to writing quality, this specific code chunk’s primary purpose is automated testing of evaluation logic, which is materially different from the declared skill behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description claims an extensive, multifunction writing-analysis and rewriting skill covering humanization, fiction editing, continuity audits, translation review, and broad long-context/book-scale review. The supplied code chunk does not implement or demonstrate those capabilities. Instead, it tests a narrowly scoped fixer/reporting CLI that removes specific mechanical stock phrases, formats reports as JSON, and optionally writes cleaned text to an output file. This is materially narrower than the declared purpose, so the description does not accurately represent the observed behavior in the provided code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code only tests functions named lint_text and format_lint_report. The tests show a rule-based linting system that flags patterns such as inflated vocabulary, atmospheric clichés, false precision, structural contrast, omissions, headings, scene resets, reflective endings, dialogue clustering, and repetition, with style-specific behavior for fiction/news/academic/etc. This aligns somewhat with a narrow 'audit' or 'consistency/style review' concept, but the declared description is much broader and centered on active rewriting/humanization, editing, continuation, translation-fidelity review, and long-form/whole-book agentic analysis. None of those primary capabilities are evidenced in this code chunk. The actual behavior is a heuristic detector/reporter, not a humanizer or rewriting assistant, so the description materially overstates and misrepresents what the code does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code chunk does not implement any of the declared writing-humanization, proofreading, fiction editing, continuity auditing, or translation-fidelity behaviors. Instead, it is purely a test module for a packaging/build script. Its primary purpose is software packaging validation and filesystem assertions, which is materially different from the declared end-user writing assistant functionality. This is not just a supporting implementation detail of the skill behavior presented to users; it is unrelated infrastructure/testing code, so the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

`fix`, `verify`, or `pipeline` rather than judging the package from `SKILL.md` alone.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · humanwriting/linter.py (reported line 792)May include surrounding context.

python

paragraphs = _paragraph_spans(masked)

    def enabled(rule_id: str, category: str) -> bool:
        return rule_id not in allowed and category not in allowed

    # A single cinematic opening can be useful. Repeated fingerprints across a
    # passage are the signal that the writer is reusing a presentation recipe.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises an executable Python package, shell-invokable CLI, file I/O, optional MCP coordination, and possible network/environment interactions, but the manifest does not declare any tool scope or allowed-tools boundaries. That omission weakens host-side least-privilege enforcement and can let the skill be invoked with broader capabilities than users or reviewers expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest uses extremely broad trigger phrases spanning generic writing, proofreading, novels, reports, academic, legal, and technical prose across multiple languages. Overbroad activation criteria can cause the skill to intercept unrelated requests and apply rewriting, file-reading, or audit workflows in contexts where the user did not intend this higher-capability skill to run.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The opening message instructs users that typing the Chinese phrase "更新账本" will trigger ledger updates. This introduces a language-specific interaction requirement in otherwise English-language documentation, without user opt-in or justification for the locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description forces a specific language/locale in its natural-language content, which can violate language-choice policy when no opt-in or alternative is provided. There is no indication that this is a region-specific or compliance-mandated variant, nor any note offering users a language option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file contains natural-language instructions entirely in Simplified Chinese and does not indicate that the user can choose another language or that the skill is intentionally restricted to a Chinese-language audience. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The template’s example values and wording are written entirely in Chinese, despite the file title presenting it as a general template rather than a clearly region-specific or Chinese-only skill. There is no natural-language note indicating that users may choose another language or locale, which can violate language-choice policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_skillhub_package.py:12