ClawHub
Back to skill

Security audit

Dizest Summarize

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate remote summarization skill, but it sends user-provided content to a third-party API without a clear privacy warning or consent step.

Install only if you are comfortable sending the material you ask it to summarize to Dizest's external API. Avoid using it for secrets, credentials, private keys, regulated personal data, or confidential documents unless your organization has approved that external processing. Use the HTTPS API-key page rather than the README's HTTP link.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Warning
Location
SKILL.md:32
Finding

Unrestricted Forwarding of User Content to a Third-Party API

Content
View full analysis
" } ``` **Request Body (with custom instructions):** ```json { "content": "", "custom_instructions": "" } ``` ``` ### Technical Analysis The Skill requires the agent to transmit user input to `https://api.dizest.ai/v1/summarize`, which is expected for a remote summarization service. However, the instruction to forward the input “exactly as provided,” combined with an explicit prohibition against preprocessing, creates an excessive-disclosure risk. The Skill does not instruct the agent to: - Inform the user that content will be disclosed to a third party. - Obtain confirmation before uploading confidential or regulated material. - Detect or redact credentials, access tokens, personal data, or unrelated conversational context. - Restrict the request body to the minimum content necessary for summarization. - Offer a local or privacy-preserving alternative. Consequently, a request containing embedded secrets, confidential documents, private transcripts, or unrelated context may be transmitted in full. Authentication through the `DIZEST_API_KEY` i ...[truncated 1639 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
README.md:24
Finding

API-Key Enrollment Link Uses Plaintext HTTP

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README encourages users to pass arbitrary content, URLs, PDFs, and notes to the skill but does not clearly disclose that the submitted material is transmitted to an external third-party Dizest API for processing. This can cause users to unintentionally send sensitive or proprietary data off-platform, creating confidentiality, privacy, and compliance risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is designed to send user-supplied content to a third-party API, but it does not clearly require the agent to warn users that their text, URLs, PDFs, notes, or transcripts will leave the local environment and be processed externally. This can cause unintended disclosure of sensitive or regulated data if users assume summarization happens locally or within the host platform.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This endpoint transmits raw user content to https://api.dizest.ai/v1/summarize, which is an external service outside the agent runtime. Even over HTTPS, sending arbitrary user input to a third party can expose confidential business data, personal information, or sensitive documents if the user is not adequately informed or if the content is high-sensitivity.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

Endpoint:

text
POST https://api.dizest.ai/v1/summarize

Headers:

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The SSE retrieval endpoint streams execution results from the external Dizest service back through the agent, confirming that user-submitted content is processed remotely and that potentially sensitive summaries may traverse an external channel. While expected for the feature, it still represents third-party data handling risk and should be treated as a real privacy/security concern.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

Preferred: Server-Sent Events (SSE) Stream

text
GET https://api.dizest.ai/v1/executions/<execution_id>/events

Headers:

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The fallback polling endpoint is another external transmission path for processed user data. Its presence is not inherently malicious, but it expands the same third-party exposure surface: user content and derived summaries are handled outside the platform, which can be problematic for sensitive inputs without explicit disclosure and consent.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

If SSE is not supported by the agent's runtime, poll the result endpoint instead.

text
GET https://api.dizest.ai/v1/executions/<execution_id>/result

Headers:

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Earlier documentation says the agent must act as a thin client, must not extract or parse URLs, and must forward the user's input to the API exactly as provided. However, this section instructs the agent to extract focus text into custom_instructions and pass only the remaining content as content, which is active preprocessing of the user's input.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.