sepia Hit 2,618 Stars in 18 Days, So We Ran Its Ban List Against Our Own 96 Articles
A de-AI writing skill with 2,618 stars and 916 lines of Python, none of which touches prose. We ran its vocabulary ban list across our own 127,777 published words and the top hit was a false positive 31 times out of 31.
The WJS Desk
Sep 16, 2026 · 6 min read
sepia went from nothing to 2,618 stars in 18 days, at roughly 145 a day, on 167 forks and 5 watchers. It is a "de-AI writing skill": an Agent Skills package that takes AI-generated prose and edits out the things that make it read as machine-written. We run a site with a hard anti-slop rule of our own, so this one was going to get read closely either way.
The repo is 2,761 lines of markdown and 916 lines of Python, and the Python does not touch prose at all. It is a version-consistency checker and its tests. The entire product is text that an agent loads into context.
What it actually is
Four operations, and the separation is the good idea: write, review (diagnose without editing), refactor (minimal in-place edits), and recreate (full rewrite from an extracted fact list). A routing table sends text down a different path depending on what it is:
Release notes, changelogs → professional-pass + domains/release-notes
PR replies, review comments → professional-pass + domains/dev-replies
Incident postmortems / RCA → professional-pass + domains/postmortems
Technical articles, blog posts → professional-pass + domains/tech-articles
Fiction / narrative essays → narrative-pass → discourse-pass → style-passUnderneath that sits a surface-style pass with a seven-item defect taxonomy ordered by how often professional editors actually fixed each one, a table of syntax shapes reported at 2 to 5 times human rate in LLM prose, and a vocabulary ban list of roughly 60 words and phrases.
The citation is real, which is not a given
The skill leans on arXiv 2604.03136 and quotes hard numbers from it. Papers get invented in repos like this, so we checked. It is real: StoryScope: Investigating idiosyncrasies in AI fiction, by Russell, Rajendhran, Pham, Iyyer and Wieting. Both headline figures the skill quotes appear in the abstract: 93.2% macro-F1 for human versus AI detection from narrative features alone, and 68.4% macro-F1 for six-way authorship attribution.
The skill also marks which of its own rules are measured and which are its own inference, in almost every section. That is rarer than it should be, and it is the reason we kept reading.
We ran the ban list against ourselves
The obvious test: take the §3 vocabulary list and run it over our own corpus. 96 published articles, 127,777 words.
Result: 45 hits, or 0.35 per 1,000 words. Zero em-dashes, which our own build gate guarantees.
Then we looked at what got flagged. The single most common hit was "harness", 31 times, which is 69% of every hit in the corpus. All 31 are the noun. Twelve are the product name DeepSeek Harness, the rest are "agent harness" or "test harness", a term of art we use because it is the correct word. The banned item is the performance verb, as in harnessing potential. We used it zero times.
Strip that one word and our real rate is 14 hits across 127,777 words, or 0.11 per 1,000.
The repo predicts this exactly. Its §7 whitelist says a single hit is not a verdict, that "slop is cumulative", that banned words inside quoted or in-world material keep their texture, and that over-correction is its own fingerprint: "imperfection-injection is a detectable gimmick". Our 100% false-positive rate on the top hit is a demonstration of the rule, not a hole in it.
Where it disagrees with us, and is probably right
Our house rule bans the em-dash outright, in every field, enforced at build time. sepia's whitelist explicitly rejects em-dash frequency as a model-agnostic tell, and brings measurements: per 1,000 words it reports 10.62 for GPT-4.1, 9.09 for Claude Opus 4.6, 1.43 for GPT-5.4, 0.00 for Llama 3.x, against a human mean of 3.23 across eight essays. Its conclusion is that the glyph is a property of a specific release, not of machines in general.
We think that is correct and we are keeping our rule anyway, because ours is not a detector, it is a house style with a build gate attached. But the distinction is one we had been sloppy about, and reading this is what made it obvious.
What it does not do
- There is no CLI. You cannot lint a file. There is no binary, no API, no way to score text without an agent in the loop.
- Output is probabilistic. Every rule is advisory prose. Whether the whitelist gets applied depends on whether the model honours it that run.
- Two languages. English throughout, plus a Chinese recalibration file. Nothing else is tuned.
- One voice profile ships. The registry is built for many; Hemingway is the only body in the box.
- It will not beat a detector, and says so. The skill states plainly that it is "tuned to pass no automated AI-text detector". Honest, and probably not what a chunk of those 2,618 stars wanted.
The hidden cost is context. A full technical-article route loads SKILL.md plus five reference files: 56,915 bytes, which is roughly 14,200 tokens before your text arrives. That is a real per-invocation tax on every piece you run through it, and it is the number that decides whether this belongs in your pipeline or in your editor.
How it compares to just writing a regex
Our own gate is a 200-line JavaScript file that blocks dashes, seven filler phrases, and five title patterns. Blunt, and it has held.
| Dimension | sepia 0.10.0 | Our regex gate |
|---|---|---|
| Distinct tells covered | 7 defect classes, 7 syntax templates, ~60 vocab items | Dashes plus 7 phrases |
| Citations you can verify | arXiv 2604.03136, checked | None |
| Runs in CI with no model | No | Yes |
| Context cost per run | ~14,200 tokens | Zero |
| Deterministic result | No | Yes |
Who made it, and does it survive them leaving
158 commits from 5 contributors, with Nanako0129 at 140 of them, or 88%. Bus factor of one. The cadence tells its own story: 28 commits on 5 September, then 6, then 8, then 2, then nothing for the four days up to writing.
The mitigating detail is that it is MIT and it is markdown. There is nothing to maintain in the usual sense, and vendoring the two files you actually use is a five-minute job. It also wires real behavioural evals into CI, running the eval suite against graders with a no-plugin baseline arm for the score delta, which is more rigour than most repos at this star count bother with.
Verdict
Adopt it as reading, today, if you write anything that ships with your name on it. The seven-artifact taxonomy and the false-positive whitelist are worth the hour even if you never install the skill.
Wait if you wanted a linter. It is not one, it will not become one, and the 14,200-token route means putting it on every commit costs real money. What would change our mind is a deterministic subset: the syntax templates and the cumulative-hit scoring are mechanisable, and nobody has done it.
Your move
Run its word list over your own docs before you believe anything we said. The number we want: what was your top hit, and was it actually slop or just a word your domain uses correctly? Ours was one word, 31 times, wrong 31 times, and we would bet yours is too.
If you are weighing whether a repo at this star count has done the engineering behind the README, our piece on the 32,897-star repo whose own evals failed its release gate is the cautionary version of the same check. sepia passes it, which is most of why this piece exists.
