It is an editing skill with a separate detector
avoid-ai-writing gives an agent a detailed editorial procedure: identify suspicious habits, preserve the writer's claims, rewrite the weak parts, and inspect the result again. The default mode rewrites, detect mode only reports findings, and edit mode changes prose files in place. Voice profiles cover casual, professional, technical, warm, and blunt writing. The same SKILL.md format works in Claude Code, Codex, OpenClaw, Hermes, and other Agent Skills clients.
The repository also contains a JavaScript detector with 48 machine-readable categories, a 0 to 100 score, and local MCP tools named score_text and audit_text. The MCP server sends no text to a network service. That distinction matters: the skill asks a language model to make editorial judgments, while the detector applies fixed rules and document statistics. A clean score does not certify human authorship, and a flag does not prove model use.
The 0 to 100 score is not calibrated for authorship decisions
Issue 70 records a blunt result from the project's own corpus: across 875 human and 779 machine paragraphs, no sample scored above 11 out of 100. At a threshold of 15, both classes produced zero hits. A scale can still help compare two drafts, but labels such as “minimal AI signals” carry little weight when ordinary samples occupy roughly one tenth of the stated range.
The category data is more revealing. Issue 71 reports that sentence and paragraph uniformity fired 11.7 times as often on machine text, while the 112-entry vocabulary table had a 0.9 lift and fired slightly more often on human text. The maintainer treats this as a direction problem and leaves the evidence visible. Buyers should do the same: use word replacements as editing advice, and reserve authorship claims for a properly validated classifier.
The corpus misses current models and four target registers
Every machine item in the current corpus predates 2025, according to issue 72. Its 373 RAID samples come from 2024 and its 406 HC3 samples from 2022. Those datasets do not represent a current model writing release notes, LinkedIn posts, investor email, or README copy. Reweighting the detector against that material could optimize it for habits that newer systems no longer share.
Human coverage has a parallel hole. Issue 85 lists 26 blog sources, 4 literary essays, 3 academic sources, 2 mixed sources, and 1 technical blog. It lists zero sources for docs, social, email, and conversational prose, despite those being named contexts in the tool. This is a real reason to walk away if false-positive rates affect moderation, hiring, assessment, or discipline. The project says its current false-positive figure cannot be published until those cells have adequate coverage.
What happened when we ran it
Our sandbox installed commit 40328bd in 9 seconds. Npm installed 0 packages, and the checkout occupied 2 MB after installation. The repository has 50 files and about 6,975 lines of source. There was no build script or target, so we skipped that step instead of inventing one.
Tests succeeded in 10 seconds. Npm audit reported 0 known vulnerabilities: 0 critical, 0 high, 0 moderate, and 0 low. The repository contains 4 CI workflow files, with no Dockerfile and no tests directory. Those facts describe our fresh Debian run with 3 CPUs, 8 GB of RAM, no secrets, and the stated commit. They do not measure rewrite quality or detector accuracy.
Installation changes by agent, and the plugin has a packaging gap
The direct route is simple: copy SKILL.md into the directory your agent scans. The repository's JavaScript detector supports Node 18 or newer. The documented convenience command pins skills@1.5.23, but that installer requires Node 22.20.0 or newer. Claude Cowork loads the project as a plugin, Cursor uses a separate rule file, and Hermes has its own skills path. None of the local detector paths require hosted credentials.
One open packaging issue is easy to miss. Issue 102 says the plugin bundle ships only SKILL.md, even though the file references scripts/check-style.js and an examples/ directory that are absent from that bundle. The report says the missing invocation returns an ENOENT error and the model continues. Teams standardizing on the plugin should test the exact artifact they distribute instead of assuming a repository clone and plugin install contain the same files.
Edit mode protects code, while Markdown source can skew a score
Release v3.26.0 changed edit mode so it refuses source code, configuration, and generated data. That is the correct boundary for a prose rewriter because a stylistic edit can corrupt syntax or serialized values. The README also says edit mode preserves passages that already read naturally and returns a report of edits and verification instead of dumping the whole file.
Raw Markdown still has a known scoring problem. Issue 123 shows comments and YAML frontmatter changing the detector result even though readers never see those blocks. In its reproduction, plain prose scored 0, the same prose with a comment scored 21, and frontmatter raised it to 15. Until rendered-Markdown masking exists, strip non-rendered metadata before comparing scores.
Active maintenance does not settle the detector's claim
GitHub recorded 3,554 stars, 24 combined issues and pull requests, and a last push on August 24, 2026. Release v3.26.0 landed the same day. Open discussions cover calibration, current-model coverage, Markdown masking, packaging, and possible new distribution formats. That is healthy issue activity around concrete limits, though the combined count is not a bug total.
The project is easiest to recommend as an editor's checklist. Its patterns catch inflated claims, vague sourcing, canned transitions, repeated rhythm, and chatbot residue, while detect mode lets a person reject bad flags. Our 9-second install and passing tests make evaluation cheap. The numeric detector is the weaker product today, especially when someone wants to infer authorship. Keep a human in the loop and treat every score as a lead to inspect, not a verdict on who wrote the text.