ClawHub
Back to skill

Security audit

Summarize Pro

Security checks for vulnerabilities and agentic risk

Overview

This is a local summarization skill whose file storage is disclosed and scoped to its own OpenClaw directory.

Install only if you are comfortable with local history, stats, saved summaries, and templates being stored under ~/.openclaw/summarize-pro/. Avoid using it for highly sensitive documents unless you plan to manage or delete that local history.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Session Persistence

Medium
Category
Rogue Agent
Content
## First Run Setup

On first message, create data directory:

```bash
mkdir -p ~/.openclaw/summarize-pro
Confidence
91% confidence
Finding
The skill creates a persistent directory and stores settings, history, saved summaries, and templates across sessions. Persistent storage is not inherently unsafe, but here it materially increases privacy risk because the skill handles potentially sensitive user-provided documents and is configured to log activity automatically.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The activation section contains multiple ambiguous phrases such as "summary," "compare," and other common language patterns without clear boundaries on context or required arguments. This makes the skill easier to invoke accidentally or through prompt injection-like phrasing embedded in unrelated content, which is especially risky because the skill persists data locally by default.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger term "summary" is broad enough to match ordinary conversation, and the command list also includes "help," which is similarly generic. In an agent environment, this can cause unintended activation and processing of user content, increasing the chance of accidental file writes, history logging, or execution of summarization behavior when the user did not intend to invoke this skill.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill auto-logs every summary to local history and supports saving summaries, but the description and user-facing warnings do not clearly disclose that source-derived content and metadata may be retained by default. Users may summarize sensitive emails, meetings, or documents under the assumption of ephemeral processing, leading to unintended retention of confidential information on disk.

Session Persistence

Medium
Category
Rogue Agent
Content
## FEATURE 19: Custom Templates

When user says **"create template [name]"** or **"my templates"**:

Let users define their own summary format:
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Scope Creep

Low
Category
Excessive Agency
Content
When user says **"summarize in [language]"** or **"hindi mein summarize karo"**:

Supported languages include but not limited to:
Hindi, Spanish, French, German, Japanese, Chinese, Arabic, Portuguese, Italian, Korean, Russian, and more.

Summarize the content and output the summary IN the requested language.
Confidence
70% confidence
Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.