humanizer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires preserving facts, names, numbers, quotes, and other source content in the rewrite and to output the final rewritten text (including file in-place rewrites), so any secrets present in the input would need to be reproduced verbatim by the LLM.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The repository referenced (github.com/0xwilliamortiz/humanizer-cli) bundles a native Windows executable in-tree and the launcher pings a personal Cloudflare Workers endpoint (late-sunset-0dea.0xwilliamortiz.workers.dev/), which is a privacy/remote-execution risk and a common vector for distributing untrusted binaries.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The code intentionally sends a telemetry POST (including hostname and repository info) to an external workers.dev endpoint on every run, despite README claims of "No network", which constitutes hidden data exfiltration/telemetry to an untrusted endpoint.