ClawHub
Back to skill

Security audit

Chat Summary

Security checks for vulnerabilities and agentic risk

Overview

This skill summarizes chat history and can save summaries locally or to external services, and those behaviors are disclosed and aligned with its stated purpose.

Install this only if you are comfortable letting the agent process selected chat history. Use explicit session limits and output choices, avoid sensitive or private conversations, and enable Notion or translation providers only when you intend to send summary text to those services and use their API keys.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (18)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill advertises exporting chat summaries to Notion and local files and references reading an API key from another skill entry, which introduces external data transfer and credential use beyond a simple summarization function. In a chat-history skill, undocumented or under-emphasized outbound writes are risky because users may expose sensitive conversation content to third-party services or persistent storage without realizing it.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill advertises exporting chat summaries to Notion and local files and references reading an API key from another skill entry, which introduces external data transfer and credential use beyond a simple summarization function. In a chat-history skill, undocumented or under-emphasized outbound writes are risky because users may expose sensitive conversation content to third-party services or persistent storage without realizing it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly supports output to Notion and local files but does not present a clear user-facing warning that chat content may be written to third-party services or persisted on disk. Because the skill operates on conversation history, this creates a meaningful confidentiality risk: users may believe they are requesting an ephemeral summary when the content is actually stored externally or locally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrases are very broad everyday requests such as summarizing today's discussion or organizing a recent chat, which increases the chance of accidental invocation. In this skill's context, unintended activation is more dangerous because the skill reads conversation history and may export summaries, potentially processing or writing sensitive content without deliberate user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The optional translation section mentions DeepL, Google Translate, and OpenAI translation without warning that chat text may be transmitted to external providers. In a summarization skill handling potentially sensitive chat logs, third-party transmission materially increases privacy and compliance risk, especially for private, internal, or regulated conversations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The entire skill guidance, examples, and labels are written only in Chinese, with no indication that the user can choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is documented and justified.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/notion-api.md (reported line 12)May include surrounding context.

创建页面

bash
curl -X POST "https://api.notion.com/v1/pages" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Notion-Version: 2022-06-28" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/notion-api.md (reported line 12)May include surrounding context.

创建页面

bash
curl -X POST "https://api.notion.com/v1/pages" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Notion-Version: 2022-06-28" \
  -H "Content-Type: application/json" \

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This reference document expands a summarization skill into translation and third-party API integration, which materially changes the data-handling model of the skill. In the context of chat-summary, this is dangerous because users may reasonably expect local/topic summarization, while the guidance encourages sending chat content to external services without clear scope boundaries, privacy review, or consent controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The examples show raw chat or summary text being sent to DeepL, Google, OpenAI, and LibreTranslate, but do not warn that potentially sensitive conversation content will leave the system and be processed by third parties. For a chat summarization skill, this creates a significant confidentiality and compliance risk because discussion logs, meeting notes, or private conversations may be transmitted externally without informed consent or minimization.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This duplicate finding points to the same outbound HTTP example, which is a true data-exposure risk because it normalizes posting user text to an external service. Within a chat-summary skill, that increases the chance that operators or downstream implementations will unknowingly leak confidential conversation data during translation.

Content

Scanner excerpt · references/translation.md (reported line 61)May include surrounding context.

python
import requests

response = requests.post("https://libretranslate.com/translate", json={
    "q": "你好",
    "source": "zh",
    "target": "en",

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This duplicate finding points to the same outbound HTTP example, which is a true data-exposure risk because it normalizes posting user text to an external service. Within a chat-summary skill, that increases the chance that operators or downstream implementations will unknowingly leak confidential conversation data during translation.

Content

Scanner excerpt · references/translation.md (reported line 61)May include surrounding context.

python
import requests

response = requests.post("https://libretranslate.com/translate", json={
    "q": "你好",
    "source": "zh",
    "target": "en",

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

This code embeds a fixed language/locale policy by only recognizing zh-CN, zh-TW, en, ja, and ko, and presents it as automatic language detection. There is no user-facing mechanism to choose supported locales, opt out, or documentation justifying the restriction as region-specific, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This code file contains natural-language descriptions and runtime messages in Chinese, including the module docstring and CLI help text, without clearly offering the user a general interface-language choice for those descriptions. Although output content supports multiple languages, the skill's own instructions and prompts are still language-specific, which can violate a language/locale policy requiring user choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest limits the skill's purpose to organizing and summarizing chat history by topic, with no mention of publishing or exporting summaries to third-party services. The presence of a dedicated Notion export function adds an external content-delivery capability that goes beyond the described summarization scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Creating pages in Notion is a separate integration capability, not an obvious requirement for clustering chat topics and generating structured summaries. Since the manifest focuses on summary generation and multilingual support, external publishing introduces functionality that is not clearly justified by the declared purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file documents a curl command that reads an API key and sends content to the Notion API, which affects remote data and uses credentials. The guide provides the mechanics of the request but does not include any warning about protecting the key, avoiding accidental disclosure, or confirming that page content will be transmitted to an external service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The natural-language system prompt "Translate to English" imposes a specific output language in the example. Because the file otherwise discusses translation generally, this fixed-language instruction could conflict with a policy requiring language choice or user opt-in unless it is clearly framed as only an example.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.