Agent Economy Report

Skill code audit

CAUTION version 1.0.0 · audited 2026-09-17

humanizer @biostartechnology

This package is a markdown-only writing-editing skill for an AI agent. It teaches the agent to find common AI-style wording and rewrite the text so it sounds more natural, without adding any executable program code. It requests only file reading, file writing, and a user-question tool; no shell, network, credential, or payment access is requested. The files contain documentation links to Wikipedia and ClawHub, but no instruction to call them at runtime. The publisher itself notes the skill could be used to make AI-generated writing appear human-written, so users should apply disclosure rules and review edited files.

Declared purposeRemove signs of AI-generated writing from text and rewrite it to sound more natural while preserving meaning and tone, based on Wikipedia's Signs of AI writing guide.
Observed behaviorThe skill is an instruction set rather than executable code. It tells the agent to identify listed AI writing patterns, rewrite problematic sections, preserve meaning and tone, and output the humanized text. The frontmatter requests Read, Write, Edit, Grep, Glob, and AskUserQuestion. No runtime network, shell, credentials, payments, or persistence behavior is described.
Verdict, rules onlySAFE
Verdict, AICAUTION
Final verdictCAUTION (never better than either pass)

Capabilities

capabilityvs purposedetail
filesystem_readneededFrontmatter permits Read, Grep, and Glob (SKILL.md lines 12, 15-16) so the agent can read input text or locate documents to humanize.
filesystem_writeneededFrontmatter permits Write and Edit (SKILL.md lines 13-14) so the agent can output rewritten text or edit documents in place.
otherneededFrontmatter permits AskUserQuestion (SKILL.md line 17) so the agent can ask the user about preferences or documents.

Findings

severityfinding
infoDeclared purpose
The frontmatter states the skill is for editing or reviewing text to remove AI-generated writing patterns.
SKILL.md:4 Remove signs of AI-generated writing from text. Use when editing or reviewing
infoRequested capabilities are limited
The allowed-tools section (SKILL.md lines 11-17) lists only Read, Write, Edit, Grep, Glob, and AskUserQuestion. It does not request shell, network, credential, or payment tools.
SKILL.md:11 allowed-tools:
infoAgent role instruction
This line assigns the agent a style-editing role. It is ordinary skill guidance and does not instruct access to credentials, payments, or the network.
SKILL.md:22 You are a writing editor that identifies and removes signs of AI-generated text to make writing sound more natural and human. This guide is based on Wikipedia's
infoInstallation command
The README shows the package is installed through the ClawHub CLI. This is documentation for installing the skill, not a runtime shell or package-installation behavior inside the skill.
README.md:10 clawdhub install humanizer
infoExternal reference link
The README links to a Wikipedia guide. This is a documentation reference only; there is no instruction to fetch the URL or send data to it.
README.md:25 Based on [Wikipedia's "Signs of AI writing"](https://en.wikipedia.org/wiki/Wikipedia:Signs_of_AI_writing) guide, maintained by WikiProject AI Cleanup. This comp
infoPublisher link
The skill card links to a ClawHub publisher page. This is a documentation-only external link, not a runtime network destination.
skill-card.md:9 [biostartechnology](https://clawhub.ai/user/biostartechnology)
lowDual-use risk disclosed
The publisher acknowledges the skill could hide AI authorship. The surrounding text says to use it only for legitimate style improvement and to follow disclosure rules. This is the main caution for users.
skill-card.md:25 Risk: The skill can be used to make AI-generated writing appear human-written without appropriate disclosure.
infoVersion mismatch
The skill-card reports a metadata version mismatch: SKILL.md frontmatter says 2.1.1, while other metadata says 1.0.0. This is not malicious behavior, but the package metadata is inconsistent.
skill-card.md:50 1.0.0 (source: server release metadata; artifact SKILL.md frontmatter says 2.1.1)

0 AI finding(s) were dropped because their file, line or quote did not match the package.

Network destinations in the code

domainservice ratingwhere
clawhub.ainot in the service indexskill-card.md:9
en.wikipedia.orgnot in the service indexREADME.md:25

Other facts

Binaries invokedbash
Environment variables readnone
Hard-coded walletsnone
Pipes a download to a shell0
eval / exec / subprocess0
base64 blobs0
File writes1
Persistence0

Files audited

filelinessha256
README.md824f3f9414dc2b7605…
SKILL.md437d7ce483d368e4301…
_meta.json69371a63c2d97d9a1…
skill-card.md543962ca08447d8182…

For agents

JSON: https://agenteconomy.report/k/humanizer.audit.json · badge: https://agenteconomy.report/k/humanizer.audited.svg · skill rating: /k/humanizer · commission an audit of any skill: US$ 29 per version.

How this is computed

The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).