ClawHub
Back to skill

Security audit

Chat Summary

Security checks for vulnerabilities and agentic risk

Overview

This skill summarizes chat history and can save summaries locally or to external services, and those behaviors are disclosed and aligned with its stated purpose.

Install this only if you are comfortable letting the agent process selected chat history. Use explicit session limits and output choices, avoid sensitive or private conversations, and enable Notion or translation providers only when you intend to send summary text to those services and use their API keys.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (18)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The skill advertises exporting chat summaries to Notion and local files and references reading an API key from another skill entry, which introduces external data transfer and credential use beyond a simple summarization function. In a chat-history skill, undocumented or under-emphasized outbound writes are risky because users may expose sensitive conversation content to third-party services or persistent storage without realizing it.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The skill advertises exporting chat summaries to Notion and local files and references reading an API key from another skill entry, which introduces external data transfer and credential use beyond a simple summarization function. In a chat-history skill, undocumented or under-emphasized outbound writes are risky because users may expose sensitive conversation content to third-party services or persistent storage without realizing it.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly supports output to Notion and local files but does not present a clear user-facing warning that chat content may be written to third-party services or persisted on disk. Because the skill operates on conversation history, this creates a meaningful confidentiality risk: users may believe they are requesting an ephemeral summary when the content is actually stored externally or locally.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger phrases are very broad everyday requests such as summarizing today's discussion or organizing a recent chat, which increases the chance of accidental invocation. In this skill's context, unintended activation is more dangerous because the skill reads conversation history and may export summaries, potentially processing or writing sensitive content without deliberate user intent.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The optional translation section mentions DeepL, Google Translate, and OpenAI translation without warning that chat text may be transmitted to external providers. In a summarization skill handling potentially sensitive chat logs, third-party transmission materially increases privacy and compliance risk, especially for private, internal, or regulated conversations.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The entire skill guidance, examples, and labels are written only in Chinese, with no indication that the user can choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is documented and justified.

External Transmission

Medium
Category
Data Exfiltration
Content
## 创建页面

```bash
curl -X POST "https://api.notion.com/v1/pages" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Notion-Version: 2022-06-28" \
  -H "Content-Type: application/json" \
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## 创建页面

```bash
curl -X POST "https://api.notion.com/v1/pages" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Notion-Version: 2022-06-28" \
  -H "Content-Type: application/json" \
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
This reference document expands a summarization skill into translation and third-party API integration, which materially changes the data-handling model of the skill. In the context of chat-summary, this is dangerous because users may reasonably expect local/topic summarization, while the guidance encourages sending chat content to external services without clear scope boundaries, privacy review, or consent controls.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The examples show raw chat or summary text being sent to DeepL, Google, OpenAI, and LibreTranslate, but do not warn that potentially sensitive conversation content will leave the system and be processed by third parties. For a chat summarization skill, this creates a significant confidentiality and compliance risk because discussion logs, meeting notes, or private conversations may be transmitted externally without informed consent or minimization.

External Transmission

Medium
Category
Data Exfiltration
Content
```python
import requests

response = requests.post("https://libretranslate.com/translate", json={
    "q": "你好",
    "source": "zh",
    "target": "en",
Confidence
96% confidence
Finding
This duplicate finding points to the same outbound HTTP example, which is a true data-exposure risk because it normalizes posting user text to an external service. Within a chat-summary skill, that increases the chance that operators or downstream implementations will unknowingly leak confidential conversation data during translation.

External Transmission

Medium
Category
Data Exfiltration
Content
```python
import requests

response = requests.post("https://libretranslate.com/translate", json={
    "q": "你好",
    "source": "zh",
    "target": "en",
Confidence
96% confidence
Finding
This duplicate finding points to the same outbound HTTP example, which is a true data-exposure risk because it normalizes posting user text to an external service. Within a chat-summary skill, that increases the chance that operators or downstream implementations will unknowingly leak confidential conversation data during translation.

Natural-Language Policy Violations

Medium
Confidence
83% confidence
Finding
This code embeds a fixed language/locale policy by only recognizing zh-CN, zh-TW, en, ja, and ko, and presents it as automatic language detection. There is no user-facing mechanism to choose supported locales, opt out, or documentation justifying the restriction as region-specific, which can violate language/locale policy requirements.

Natural-Language Policy Violations

Medium
Confidence
86% confidence
Finding
This code file contains natural-language descriptions and runtime messages in Chinese, including the module docstring and CLI help text, without clearly offering the user a general interface-language choice for those descriptions. Although output content supports multiple languages, the skill's own instructions and prompts are still language-specific, which can violate a language/locale policy requiring user choice.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The manifest limits the skill's purpose to organizing and summarizing chat history by topic, with no mention of publishing or exporting summaries to third-party services. The presence of a dedicated Notion export function adds an external content-delivery capability that goes beyond the described summarization scope.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
Creating pages in Notion is a separate integration capability, not an obvious requirement for clustering chat topics and generating structured summaries. Since the manifest focuses on summary generation and multilingual support, external publishing introduces functionality that is not clearly justified by the declared purpose.

Missing User Warnings

Low
Confidence
88% confidence
Finding
This markdown file documents a curl command that reads an API key and sends content to the Notion API, which affects remote data and uses credentials. The guide provides the mechanics of the request but does not include any warning about protecting the key, avoiding accidental disclosure, or confirming that page content will be transmitted to an external service.

Natural-Language Policy Violations

Low
Confidence
79% confidence
Finding
The natural-language system prompt "Translate to English" imposes a specific output language in the example. Because the file otherwise discusses translation generally, this fixed-language instruction could conflict with a policy requiring language choice or user opt-in unless it is clearly framed as only an example.

Static analysis

No suspicious patterns detected.