ClawHub
Back to skill

Security audit

Summarize All

Security checks across malware telemetry and agentic risk

Overview

This summarizer is mostly coherent, but its optional API server exposes high-impact unauthenticated access and arbitrary webhook forwarding.

Install only if you are comfortable sending summarized content to your configured AI provider and storing summaries locally. Avoid running server mode on shared or untrusted networks unless you add access controls, bind it locally, and restrict or disable webhook forwarding.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def merge_pdfs(pdf_paths, output_path):
    """Merge multiple PDFs into one"""
    try:
        result = subprocess.run(
            ['pdftk'] + pdf_paths + ['cat', 'output', output_path],
            capture_output=True, timeout=60
        )
Confidence
80% confidence
Finding
The code passes attacker-controlled PDF paths directly to pdftk as command arguments. Although shell injection is avoided, many CLI tools treat filenames beginning with option-like tokens specially, which can cause argument/option injection or unsafe file handling if untrusted paths are accepted.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def fetch_pdf(path):
    try:
        result = subprocess.run(['pdftotext', '-layout', path, '-'], capture_output=True, text=True, timeout=30)
        return result.stdout[:15000] if result.stdout else "[No text]"
    except:
        return "[pdftotext not found]"
Confidence
82% confidence
Finding
An untrusted local path is forwarded directly to pdftotext. This can enable option-style argument injection via crafted filenames and exposes the process to risks in the external parser when handling attacker-supplied PDFs.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def fetch_youtube(url):
    try:
        result = subprocess.run(['summarize', url, '--extract-only'], capture_output=True, text=True, timeout=30)
        return result.stdout[:15000] if result.stdout else "[No transcript]"
    except:
        return "[summarize CLI not found]"
Confidence
86% confidence
Finding
User-controlled URLs are passed into an external summarize CLI. Even without shell=True, this still trusts a helper binary to safely interpret attacker-controlled input, which can trigger unsafe behaviors, unexpected network access, or option parsing issues depending on that tool's implementation.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def fetch_audio(path):
    try:
        result = subprocess.run(['summarize', path, '--extract-only'], capture_output=True, text=True, timeout=60)
        return result.stdout[:15000] if result.stdout else "[Transcription failed]"
    except:
        return "[summarize CLI not found]"
Confidence
84% confidence
Finding
A user-supplied file path is passed to an external summarize CLI for audio extraction/transcription. This creates similar argument-injection and parser-risk issues as other subprocess uses, especially if filenames can be crafted or files are attacker-controlled.

Tainted flow: 'req' from urllib.request.urlopen (line 846, network input) → urllib.request.urlopen (network output)

Medium
Category
Data Flow
Content
headers={'Content-Type': 'application/json'},
                            method='POST'
                        )
                        urllib.request.urlopen(req, timeout=10)
                    except:
                        pass
Confidence
97% confidence
Finding
The API server accepts an arbitrary webhook URL from the POST body and performs a server-side outbound request to it. This is classic SSRF behavior and can be abused to reach internal services, cloud metadata endpoints, or other restricted network targets from the host running the skill.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The tool sends fetched remote content and local file contents to a configured external LLM endpoint without any visible user warning at the point of use. In a summarizer that accepts arbitrary local files, this can unintentionally exfiltrate sensitive data to third-party services.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The embedded server forwards summarization results to arbitrary webhook destinations with no confirmation or policy checks. This creates both SSRF risk and unauthorized data exfiltration, since summaries derived from local files or fetched content can be pushed to attacker-controlled endpoints.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.