Summarizer

• Outcome: Review
• Latest audit: Jul 27, 2026 · 10:16 AM UTC
• Version: 1.0.2

Overview

The skill is a capable summarizer, but it automatically reads and updates persistent local memory, shared contacts, and project records without asking each time.

Install only if you want a stateful summarizer that keeps local records across runs. Review or set storage preferences such as store_summaries: none before use, and be careful with confidential documents because derived titles, dates, contacts, deadlines, and project decisions may be written to local Clawic data files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (53)

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The file instructs the summarizer to persist contact records, audience preferences, templates, and reusable extracts into shared storage. That expands the skill from transient summarization into profile/memory management, creating unnecessary data retention and a wider attack surface for privacy leakage, prompt-memory poisoning, or cross-task data reuse without clear user consent.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Early in the file, the skill directs reading audience profiles and contact records from user-home paths to tailor output for named people. For a summarizer, this is beyond the least-privilege scope and can expose personal data or cause the model to rely on hidden memory when generating output for recipients, increasing privacy and misuse risk.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This section explicitly tells the skill to create and maintain audience memory, templates, and stored extracts. Persisting derived summaries and recipient preferences can accumulate sensitive information over time, enable cross-session data exposure, and let adversarial inputs influence future outputs through poisoned memory/templates.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to write release notes to local files and update memory/metadata stores after producing output. That exceeds pure summarization and creates persistent side effects on the user's filesystem and project records without a clear per-action confirmation boundary, which can lead to unauthorized modification, corruption of project state, or unintended propagation of incorrect summaries.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The instruction to read and depend on persistent project memory and templates broadens the skill from summarization into knowledge-base interaction. Even though this line is about reading rather than writing, it encourages access to local state not strictly necessary for all summarization tasks, increasing data exposure and coupling outputs to potentially stale or sensitive project memory.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This instruction extends the summarizer into project tracking by updating due items, project files, glossary entries, templates, and source registries. Such scope expansion is dangerous because a low-risk text transformation skill gains the ability to mutate operational records and task trackers, allowing accidental or prompt-induced changes to persist beyond the immediate summary task.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to read and rely on persistent local memory files before summarizing recurring reports. That extends the skill from pure summarization into stateful data access, which can expose unrelated prior user data, create cross-task contamination, and cause the agent to act on stale or attacker-planted content. In the context of a summarizer, this is more dangerous because users would not typically expect hidden retrieval from local memory when asking for a summary.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill directs the agent to update memory, glossary, due-tracking, and summary files after summarization, giving a summarizer persistent write capabilities unrelated to the immediate user request. This creates risks of unauthorized local state modification, data retention, poisoning of future runs, and silent propagation of incorrect or sensitive information into durable files. The skill context makes this more dangerous because summarization is expected to be a non-destructive transformation, not a workflow that mutates local knowledge stores.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to persist templates, style guides, and configuration files to local storage after normal summarization tasks. That expands a summarizer into a stateful file-writing tool without requiring clear user consent or tight scoping, creating risk of unintended data retention, privacy leakage, and unauthorized filesystem modification.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: The skill tells the agent to consult external memory/index files before producing output for recurring jobs. For a basic summarizer this is an unnecessary expansion of capability that can pull in stale, sensitive, or attacker-influenced local context and alter results in ways the user did not request.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to persist data into multiple files beyond producing a summary, including memory, contacts, projects, glossary, and stored summaries. This creates an over-broad side-effect surface: summarization of a single document can silently modify unrelated long-lived records, increasing the risk of data contamination, privacy leakage, and unauthorized state changes.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Maintaining contact and project records is not necessary for summarizing a legal document and expands the skill into cross-domain data management. An attacker could exploit this behavior by causing untrusted document content or inferred metadata to be written into shared records, poisoning future workflows and exposing sensitive relationship or project information.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to persist derived data about user-provided sources across runs, creating a durable knowledge base beyond the immediate summarization task. Even though the text says 'never with intact secrets,' this is still risky because summaries, chunk maps, and metadata can contain sensitive business, legal, or personal information and may later be reused outside the original user's expectations.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to perform persistent bookkeeping and write files after summarization, expanding behavior from content transformation into state mutation. This creates a risk of unauthorized local data modification, privacy leakage across tasks, and unexpected side effects if the user only requested a summary.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The instruction to read and maintain recurring-series tracking and glossary state introduces cross-session memory access that is not essential to a one-off summarization task. This can cause unnecessary retention and reuse of user-derived data, increasing the chance of privacy violations, stale-context contamination, or hidden personalization the user did not request.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill goes beyond summarization and instructs the agent to perform persistent writes to multiple shared stores: summaries, memory, glossary, contacts, due-tracking, and project files. This creates a broad side-effect surface where untrusted meeting content can be propagated, retained, and operationalized without explicit user approval, increasing the risk of privacy leakage, memory poisoning, and unintended workflow changes.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The instruction to update a shared contacts file with recurring attendees and keyed identifiers is unrelated to the core task of summarization and processes personal data from meeting content into a durable shared store. That creates unnecessary collection and retention of identity information, with risk of privacy violations, incorrect identity linkage, and cross-context data exposure.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Updating project tracking files and recurrence scheduling based on meeting summaries extends the skill into workflow automation and planning changes. Even if well-intended, transcript ambiguities or hallucinations can turn into incorrect project state, false decisions, or unintended due-tracking updates that affect downstream teams.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The template authorizes writes to shared contacts and project records, expanding this skill from summarization into durable cross-skill data management. That broader write scope increases the blast radius of prompt injection or summarization of untrusted content, because attacker-controlled text could cause persistence of unrelated or misleading data in shared stores.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The skill metadata says recurring external feeds are out of scope, yet the template includes editions and recurring-digest workflow. This creates unintended capability expansion, which can lead to persistent collection and periodic processing of ongoing sources the user did not intend this skill to manage.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The manifest excludes cross-source insight generation, but the template explicitly supports synthesis artifacts and coverage matrices. This broadens the skill beyond compression into analysis, making it more likely to derive and persist conclusions across sources without the tighter controls expected for synthesis tasks.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Maintaining a shared contacts inventory is not necessary for core summarization and causes the skill to persist personal data in a cross-skill location. In the context of summarizing meetings, transcripts, and messages, this increases privacy risk and makes prompt-injected or mistaken extraction of contact details more damaging.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Writing project decision records gives the skill project-tracking authority unrelated to plain summarization. Because summaries may include tentative statements or attacker-influenced text, persisting them as project decisions can corrupt shared project state and mislead later workflows.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The post-synthesis instructions direct the agent to write multiple persistent artifacts and update project memory, which extends beyond ephemeral summarization into stateful knowledge-base modification. In an agent environment, this can create integrity risks, accidental data retention, cross-project contamination, or unauthorized persistence of sensitive source material if invoked on untrusted inputs.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to read persistent local files such as glossary and memory state before summarizing certain articles. That expands the skill from pure stateless summarization into stateful access of user data, which can expose unrelated sensitive information and create unnecessary coupling between a summary request and local file contents. In this context the behavior appears product-motivated rather than overtly malicious, but it still increases attack surface and data access beyond the stated core task.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: memory-template.md:64