ClawHub
Back to skill

Security audit

Chat Summary

Security checks across malware telemetry and agentic risk

Overview

This is a chat summarization skill that can read conversation history and optionally save or send summaries to Notion or translation services, but those capabilities are disclosed and aligned with its purpose.

Install only if you are comfortable letting the skill read the chats you ask it to summarize. Keep exports local by default for sensitive conversations, review summaries before saving, use a limited Notion integration if exporting, and avoid third-party translation providers for confidential or regulated content unless you have approval.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The file documents use of a Notion API key and page-creation workflow, which expands the skill from passive chat summarization into authenticated external write operations. In the context of a summarization skill, this scope expansion is security-relevant because it can enable unintended exfiltration of chat-derived content into a third-party workspace.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The documentation references reading an API key and using it to create remote Notion pages, which introduces authenticated outbound access not justified by the stated summarization-only purpose. If implemented by an agent, summarized or raw conversation content could be written to Notion without users understanding that their data is leaving the local task boundary.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The guide recommends third-party API integrations that require credentials and send chat content to external providers, but does not clearly justify this against the skill's stated purpose or document the associated trust boundary change. In a chat summarization context, this can expose potentially sensitive conversation data to external services and increase credential-handling risk.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger phrases are broad everyday expressions such as '总结今天的讨论' and '把刚才的聊天整理一下', which can overlap with normal conversation and cause unintended activation. Because this skill reads conversation history and may export summaries externally or write them to disk, accidental triggering can expose more data than the user intended.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly reads session history and supports exporting summaries to Notion and writing Markdown to a local directory, but the documentation only gives a brief privacy note and does not clearly warn about data access, retention, or third-party transfer risks. In a chat-summary context, this is especially sensitive because conversation histories often contain private, confidential, or regulated information, so silent retrieval and persistence materially increase exposure.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The document shows an API request that writes content into a Notion workspace but does not clearly warn that executing this flow will create remote content. For a chat-summary skill handling potentially sensitive conversations, lack of disclosure increases the risk of silent data transfer and user surprise.

Missing User Warnings

Low
Confidence
90% confidence
Finding
The authentication section exposes the existence and source of a Notion API key without any guidance on secure storage, redaction, or avoiding disclosure in logs and outputs. This can normalize unsafe credential handling and increase the chance that secrets are copied, printed, or misused by downstream automation.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The examples show sending text to DeepL, Google, OpenAI, and LibreTranslate without warning that user chat content is transmitted to third parties. For a skill that processes chat histories and meeting notes, this omission is risky because users and implementers may unknowingly export confidential or regulated data.

External Transmission

Medium
Category
Data Exfiltration
Content
## 创建页面

```bash
curl -X POST "https://api.notion.com/v1/pages" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Notion-Version: 2022-06-28" \
  -H "Content-Type: application/json" \
Confidence
93% confidence
Finding
curl -X POST "https://api.notion.com/v1/pages" \ -H "Authorization: Bearer $API_KEY" \ -H "Notion-Version: 2022-06-28" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
## 创建页面

```bash
curl -X POST "https://api.notion.com/v1/pages" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Notion-Version: 2022-06-28" \
  -H "Content-Type: application/json" \
Confidence
93% confidence
Finding
https://api.notion.com/

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.