humanizer
Verdict safe, but 2 findings (2 low), mainly policy violation, data exfiltration. Most recent scan 2026-02-06.
The 'humanizer' skill is a text analysis and rewriting tool that appears to be SAFE with only minor documentation and packaging issues. The skill provides legitimate functionality for detecting and removing AI-generated text patterns. The bash scripts are simple wrappers that execute Node.js code without any malicious behavior - no data exfiltration, no credential theft, no command injection, and no prompt injection attempts. The main concerns are: (1) missing optional metadata fields that would improve transparency, (2) missing referenced Python files that may indicate incomplete packaging, and (3) undocumented Node.js dependencies. All findings are LOW severity and relate to documentation/packaging quality rather than security threats. The skill does not attempt to manipulate the agent, exfiltrate data, or perform unauthorized operations.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
The two scanners disagree: Cisco found nothing and SkillSpector says do not install. One of them has a blind spot here; read the skill before trusting either. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Humanize AI-generated text by detecting and removing patterns typical of LLM output. Rewrites text to sound natural, specific, and human. Uses 24 pattern detectors, 500+ AI vocabulary terms across 3 tiers, and statistical analysis (burstiness, type-token ratio, readability) for comprehensive detection. Use when asked to humanize text, de-AI writing, make content sound more natural/human, review writing for AI patterns, score text for AI detection, or improve AI-generated drafts. Covers content, language, style, communication, and filler categories.
- Package
- 29 files, 206 KB
- SKILL.md
- 1166 words, 12+ sections
- Code
- JavaScript (14), Shell (2)
SKILL.md covers: Humanizer: remove AI writing patterns · Your task · Quick reference: the 24 patterns · Statistical signals · Vocabulary tiers · Core principles · Write like a human, not a press release · Add personality · Cut the fat · Before/after example · Using the analyzer · Score text (0-100, higher = more AI-like)
Findings
LOW Skill does not specify a license Policy Violationstatic
Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.
SKILL.md
LOW Referenced Files Not Found in Package Data Exfiltrationllm
The skill references files 'a.py' and 'the.py' in the instructions, but these files are not found in the skill package. This could indicate incomplete packaging, broken references, or potential confusion about what files should be included.
Files referenced in instructions: a.py, the.py
**Referenced File: a.py** (not found)
**Referenced File: the.py** (not found)What is in the package
29 files, 206 KB. Show the list.
| File | Kind | Size |
|---|---|---|
README.md | doc | 16 KB |
SKILL.md | doc | 7.8 KB |
eslint.config.js | script | 559 B |
package.json | config | 1.3 KB |
vitest.config.js | script | 152 B |
assets/banner.md | doc | 331 B |
docs/CONTRIBUTING.md | doc | 2.0 KB |
docs/EXAMPLES.md | doc | 5.3 KB |
docs/PATTERNS.md | doc | 2.4 KB |
references/ai-vocabulary.md | doc | 5.5 KB |
references/patterns.md | doc | 10 KB |
references/style-guide.md | doc | 3.9 KB |
scripts/analyze.sh | script | 301 B |
scripts/humanize.sh | script | 315 B |
src/analyzer.js | script | 15 KB |
src/cli.js | script | 20 KB |
src/humanizer.js | script | 14 KB |
src/patterns.js | script | 28 KB |
src/stats.js | script | 9.5 KB |
src/vocabulary.js | script | 15 KB |
tests/analyzer.test.js | script | 13 KB |
tests/calibration.test.js | script | 7.2 KB |
tests/edge-cases.test.js | script | 7.1 KB |
tests/humanizer.test.js | script | 6.4 KB |
tests/performance.test.js | script | 3.2 KB |
tests/statistics.test.js | script | 7.9 KB |
tests/fixtures/ai-sample-1.txt | doc | 2.2 KB |
tests/fixtures/ai-sample-2.txt | doc | 1.1 KB |
tests/fixtures/human-sample-1.txt | doc | 1.1 KB |
External hosts referenced
github.com img.shields.io en.wikipedia.org arxiv.org test.org
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
DIR
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/ai-humanizer
- Raw scan result: humanizer-scan.json
- Badge for your README:
- Request a re-scan