humanize

Fail

Audited by Socket on Mar 10, 2026

1 alert found:

Obfuscated File
Obfuscated FileHIGH
scripts/humanize-api.py

The script is a straightforward client that transmits user-provided content and a stored API key to a hardcoded third-party service (humanize.undetectable.ai) and polls for a processed result. There are no classic malware constructs in the file (no remote shell, no obfuscated loader, no system tampering). The primary security/privacy risks are data exfiltration of arbitrary files/text and exposure of the API key if the config file is not properly protected or if the remote service is untrusted or compromised. Recommendations: verify and trust the remote service before use; restrict filesystem permissions on ~/.humanize/config.json (e.g., 600) and advise the user not to submit sensitive files or secrets; add optional confirmation before uploading large or potentially sensitive files; consider redaction/warnings and better error handling and permission checks.

Confidence: 98%
Audit Metadata
Analyzed At
Mar 10, 2026, 03:38 PM
Package URL
pkg:socket/skills-sh/dandcg%2Fclaude-skills%2Fhumanize%2F@7dc0e1e813ef6dc4f48c3b0b3fff54d027f5d218