ClawHub
Back to skill

Security audit

Text Summarizer

Security checks for vulnerabilities and agentic risk

Overview

This is a local text summarizer that reads user-provided text or a file and prints an extractive summary, with no evidence of network exfiltration, persistence, or hidden privilege use.

Install only if you are comfortable letting the agent summarize text or files you intentionally provide. Treat summaries as selected excerpts rather than guaranteed-complete or risk-free interpretations, especially for legal, medical, financial, or nuanced documents.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Context Leakage

High
Category
Data Exfiltration
Content
Final score = `0.4 × normalized_TF-IDF + 0.6 × normalized_TextRank`

The 60/40 weighting toward TextRank reflects TextRank's ability to capture contextual importance and sentence relationships, while TF-IDF provides a complementary signal about term specificity.

## Why These Algorithms Work
Confidence
75% confidence
Finding
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill advertises file-based usage such as `summarize.py input.txt` but does not declare any explicit tool scope or permission boundary for file access. In an agent environment, undeclared file-read capability can cause the skill to be invoked on arbitrary local files or user-provided paths without clear authorization controls, increasing the risk of unintended data exposure.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger language is very broad, covering generic phrases like 'summarize this', 'TL;DR', and 'key points', which overlap with common assistant behavior. In an agent-routing context, this can cause over-invocation of the skill on arbitrary pasted content or files, potentially widening access to sensitive text and increasing the chance the skill handles data outside the user's intended scope.

Natural-Language Policy Violations

Low
Confidence
88% confidence
Finding
The statement 'Optimized for English prose' is a natural-language locale limitation. Because the description does not offer language choice or frame the restriction as a narrowly justified regional/compliance requirement, it may conflict with language/locale policy expectations.

Intent-Code Divergence

Low
Confidence
95% confidence
Finding
The documentation makes an absolute safety claim that extractive summarization has 'zero hallucination risk.' While extractive methods generally reduce fabrication compared to abstractive methods, they can still mislead through sentence selection, omission of qualifiers, or decontextualized excerpts. This overstatement can cause users to place undue trust in outputs.

Natural-Language Policy Violations

Low
Confidence
81% confidence
Finding
Line L60 includes a natural-language locale constraint that privileges English and notes other languages require different tokenization. Under the policy, language restrictions should either be optional for the user or clearly justified as region- or compliance-specific, which is not present here.

Static analysis

No suspicious patterns detected.