The Agent Skills Directory

[DATA_EXFILTRATION]: The skill transmits user-supplied text to the external endpoint https://humanizerai.com/api/v1/detect. While this is consistent with the skill's stated purpose, it facilitates the transfer of data to a third-party service.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the ingestion of external data.
Ingestion points: Data from the HumanizerAI API response is integrated into the agent context as described in SKILL.md.
Boundary markers: There are no explicit instructions or delimiters used to ensure the agent ignores potentially malicious instructions embedded in the API response.
Capability inventory: The skill is configured to use the WebFetch tool for network communication.
Sanitization: The skill relies on basic templating without formal sanitization of the content returned by the external service.
[CREDENTIALS_UNSAFE]: The instructions correctly use the $HUMANIZERAI_API_KEY environment variable placeholder, avoiding the risks associated with hardcoded secrets.
[SAFE]: The provided skill-report.json contains internal security findings and safety claims. These are noted but are not considered authoritative for this security analysis.

detect-ai