ClawHub
Back to skill

Security audit

Humanizer Zh

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Chinese text-editing skill with no hidden code, persistence, credential access, or automatic execution in the reviewed artifact.

Review the text changes before accepting them, especially for factual, academic, legal, or compliance-sensitive writing. Prefer installing from a pinned commit or inspected local copy rather than running the unpinned npx command from the README.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:24
Finding

Unpinned Third-Party Package Execution in Recommended Installation Command

Content
View full analysis

Vulnerability Details

File Location: README.md, line 24
Vulnerability Type: Supply-chain risk from unpinned external tooling and mutable repository content
Risk Level: Medium

Complete Code Snippet

bash
npx skills add https://github.com/op7418/Humanizer-zh.git

Technical Analysis

The recommended installation command invokes npx without specifying a reviewed version or integrity value for the skills package. If that package is absent locally, npx may retrieve and execute its current registry version. The Git repository is also identified by a mutable repository URL rather than a verified commit.

Consequently, the effective installation code and installed Skill content can change after this project has been audited. Compromise of the npm package, its publisher account, the source repository, or its maintainer account could cause users following the documentation to execute or install attacker-controlled content.

This issue is confined to the documented installation process. The audited project itself contains no dependencies, lifecycle hooks, executable scripts, or embedded malicious code.

Attack Path

  1. An attacker compromises the npm package used by npx, its publisher credentials, or the referenced Git repository.
  2. The attacker publishes a malicious package version or changes content in the repository's default branch.
  3. A user follows the recommended installation command from README.md.
  4. npx retrieves and runs the current package version, which processes content from the mutable repository.
  5. The malicious installer can execute commands with the user's privileges, or it can install altered Skill instructions that affect later Agent sessions.

Impact Assessment

Successful exploitation of the npm execution path could permit arbitrary actions under the privileges of the user running the installation command, including reading or modifying user-accessible files an ...[truncated 440 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the npm installer package to a specifically reviewed version instead of allowing npx to resolve the latest release.
  • Pin the source repository to a verified immutable commit or signed release rather than its default branch.
  • Record expected cryptographic hashes or signatures and explain how users can verify downloaded artifacts before installation.
  • Prefer a non-executing installation procedure: download the small set of Skill files, inspect them, verify their hashes, and copy them into the destination directory.
  • If an automated installer remains necessary, document precisely which package is executed, what files it writes, and which permissions it requires.
  • Recommend installation as an unprivileged user and avoid commands run through sudo or an administrator shell.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The README instructs users to install the skill via npx skills add from a GitHub repository without pinning to a specific commit, tag, or version. This creates a supply-chain risk: if the upstream repo or referenced installer behavior changes, users may fetch and install different code than was originally reviewed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger '编辑或审阅文本，去除 AI 写作痕迹' is broad enough to match ordinary editing and review requests, so the skill may activate in contexts where the user did not specifically ask for AI-humanizing behavior. That can cause unintended rewriting of user content, including factual, legal, academic, or compliance-sensitive text, and may alter meaning or provenance without clear consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill heading and instructions define a Chinese-only variant ("Humanizer-zh") and the content consistently mandates Chinese-language behavior without indicating that users may choose another language. This can violate language/locale policy when a skill forces a specific language absent user opt-in or a clearly documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The package description is written entirely in Chinese and describes the skill as operating on text to make it appear more human-written, with no indication that language choice is configurable or limited for a documented regional purpose. Under the policy rule, a forced language/locale without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.