cs

Security checks across malware telemetry and agentic risk

Overview

This is a simple, coherent summarization skill; the main things to notice are that it can auto-trigger on long messages and sends the message text to the configured LLM for summarization.

This skill appears safe for normal summarization use. Before installing, be aware that long messages can trigger it automatically and that the text being summarized is sent to the configured LLM; avoid using it on secrets or sensitive documents unless that provider is approved for such data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI01: Agent Goal Hijack
Low
What this means

A long message could trigger a summary response instead of the agent continuing with another intended task.

Why it was flagged

The skill auto-matches any message longer than 100 characters, so it may summarize long text even when the user did not use an explicit summary keyword.

Skill content
return hasKeyword || text.length > 100;
Recommendation

Use this skill when automatic long-text summarization is desired; if that behavior is too broad, adjust the trigger threshold or require explicit keywords.

#
ASI07: Insecure Inter-Agent Communication
Low
What this means

Private or sensitive text included in a long message may be processed by the model used by the OpenClaw environment.

Why it was flagged

The full user message is embedded in a prompt and sent to the configured LLM provider for summarization.

Skill content
const prompt = `请总结以下文本的核心要点,用列表格式返回:\n\"\"\"\n${userText}\n\"\"\"`; ... const response = await llm.chat({
Recommendation

Avoid pasting secrets or highly sensitive content unless the configured LLM provider and workspace privacy settings are acceptable.