De-AI-fy Text Skill1.0.0

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:39 AM UTC
• Version: 1.0.1

Overview

This is a disclosed local text-processing skill that rewrites user-provided text, with some practical cautions around file overwrites, authorship transparency, and an optional unpinned dependency.

Install only if you are comfortable with a local tool rewriting text you provide. Use separate output directories, avoid pointing output at originals unless you intend to replace them, review results before publishing, disclose AI assistance where required, and pin/review the optional jieba dependency before installing it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:51

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: README.md:51
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

bash

pip install jieba

The same unpinned installation guidance is also presented by quickstart.py:209.

Technical Analysis

The installation command does not specify a reviewed package version or an integrity hash. Consequently, the package resolved and installed depends on the configured Python package index and the latest release available at installation time. This produces non-reproducible environments and creates a supply-chain exposure if the package source, maintainer account, release process, or configured index is compromised.

This finding does not establish that the current jieba package is malicious. The risk arises because the instructions implicitly trust a mutable future package release without verifying its exact version or contents.

Attack Path

1. An attacker compromises the package publisher, distribution account, upstream release process, or package index used by the victim.
2. The attacker publishes or substitutes a malicious package release under the expected package name.
3. A user follows the documented pip install jieba instruction.
4. pip resolves the attacker-controlled release because no version or hash constraint is present.
5. Malicious installation-time or import-time Python code executes in the user's environment.

Impact Assessment

Malicious dependency code could execute with the privileges of the user or automation account running pip or importing the package. Depending on those privileges, the compromise could affect project files, accessible credentials, local data, build outputs, and other resources available to that account. In privileged or CI/CD environments, the scope could extend to deployment credentials and generated artifacts.

The dependency is documented as optional, and the app ...[truncated 164 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin jieba to a specifically reviewed version rather than installing the latest available release.
2. Record dependencies in a lock file or requirements file and require verified SHA-256 hashes, such as through pip install --require-hashes.
3. Install packages only from an explicitly approved package index.
4. Review dependency updates before changing the pinned version, including package ownership, release provenance, and published artifacts.
5. Run dependency installation with least privilege inside an isolated virtual environment or container.
6. Update both README.md and quickstart.py so all installation guidance uses the same pinned and verified dependency specification.
7. Continue documenting the dependency-free fallback so users can avoid installing the optional package when enhanced Chinese segmentation is unnecessary.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file documents a command-line tool that supports file processing and batch processing, which can affect user data. The summary provides usage and capabilities but does not include any warning about reviewing outputs, backing up files, or the implications of rewriting user-provided text.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents file and directory input/output behavior but its manifest does not declare any explicit tool scope or permissions boundary. That creates an authorization and transparency gap: an agent or user may invoke a skill that reads from and writes to the filesystem without a clear, least-privilege declaration of what file access is intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The usage examples show writing output files and batch-processing directories, but the documentation does not clearly warn that files may be created or overwritten. In practice, this can lead to accidental data loss or unintended modification of large sets of user files, especially during batch operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The detector API defaults language to 'zh', and similar Chinese defaults are repeated throughout the file. This forces a specific language behavior unless the user explicitly overrides it, and the code does not present language choice as an opt-in by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The command-line interface sets --language default to 'zh', which means the tool will process text in Chinese mode even when the user has not opted into that locale. This is a natural-language policy concern because it imposes a specific language setting by default rather than requiring selection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code file contains natural-language strings and documentation that force a specific language for the user experience, including the module description, function docstrings, and console output. The policy allows locale constraints only when they are optional or clearly justified, but this file does not offer opt-in or explain why Chinese-only interaction is required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The quickstart explicitly markets the tool as making AI-generated text 'more natural' and 'more human-like', and the examples normalize disguising AI-origin text without any disclosure mechanism, consent flow, or policy boundary. In context, this increases the risk of deceptive use in academic, social, review, or moderation-sensitive settings where users may rely on signals of authorship or authenticity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This JSON defines language-specific processing paths only for Chinese and English, including AI indicators, conversion rules, and colloquial expressions. Because the file encodes locale-specific behavior in natural-language configuration with no visible indication of user selection, opt-in, or documented locale constraint, it may violate the policy against forcing a specific language or locale without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This Python test file contains user-facing/documentation-style text exclusively in Chinese, including the skill description and test labels, with no indication that language choice is optional or region-specific. Under the policy rule, forcing a specific language without user opt-in can be a locale/language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file includes command-line examples that write processed content to output files and directories, but it does not explicitly warn users that running these commands will create or overwrite output data. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or system integrity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.