Summarize File

Reads text files from workspace/paths and generates concise summaries. Handles logs, reports, CSVs, multi-line content.

Security Scan

The skill's description says it will use a workspace API and produce concise LLM summaries, but the shipped code reads a hard-coded Windows path directly, performs no sanitization, and merely returns the first 500 characters — these mismatches are significant and unexplained.

Purpose & Capability

SKILL.md and skill.json state the skill reads files via the workspace.read tool and returns LLM-generated summaries. The actual code (index.js) bypasses workspace.read and uses fs to directly open a hard-coded Windows path (C:\Users\user\.openclaw\workspace\${filename}). The code does not perform summarization, only slices the first 500 characters. This is not proportionate or coherent with the stated purpose.

Instruction Scope

The runtime instructions promise path validation, cross-platform behavior, and local-only workspace API access. The implementation lacks any path normalization/validation and concatenates user-supplied filenames into an absolute path, which likely permits path traversal (e.g., '..\') to access files outside the intended workspace. The code is also Windows-specific and contradicts the SKILL.md claims about using workspace.read and returning 2–3 sentence summaries.

Install Mechanism

There is no install script or remote download — the skill is instruction-only plus a small code file. That lowers installer risk (nothing is fetched from the network).

Credentials

The skill declares no environment or credentials (which is appropriate), but its implementation accesses an absolute user home path directly instead of using the declared workspace.read permission/API. That bypass can defeat sandboxing expectations: although no secrets are requested, direct fs access to C:\Users\user\... is broader than the declared surface and may expose unrelated local files.

Persistence & Privilege

The skill does not request always:true, does not modify other skills, and has no install-time persistence. It appears not to escalate privileges or autonomously persist configuration.

What to consider before installing

Do not install or enable this skill without changes. The code does not match the skill description: it reads a hard-coded Windows path using fs rather than the platform workspace.read API, performs no path validation (risk of reading files outside the workspace), and does not implement any LLM summarization — it just returns the first 500 characters. If you want to proceed, ask the author to (1) remove hard-coded absolute paths and use the declared workspace.read API, (2) add robust path normalization and enforce that files stay inside the workspace (no ../ traversal), (3) implement the actual summarization logic (or clearly document why it only returns an excerpt), and (4) make it cross-platform. Until these changes are made, run the skill only in an isolated environment and inspect/approve the source yourself.

Summarize-File Skill

Purpose

Extracts key insights from text files (logs, reports, notes) and returns 2-3 sentence summaries. Ignores boilerplate/empty lines.

Usage Examples

User: summarize file C:\Users\user\Desktop\report.txt Claw: File contains Q1 sales report: Revenue up 12% YoY, expenses flat, net profit +8%. Key risks: supply chain delays.

User: summarize file workspace/error.log Claw: Error log (Feb 22): 14 auth failures (IP 192.168.1.50), 2 DB timeouts, no critical crashes.

text

How It Works

1. Reads file content via workspace.read tool
2. Strips empty lines, headers, timestamps
3. Feeds to LLM with summarization prompt
4. Returns concise 2-3 sentence summary

Security & Privacy

• L1 Risk: Read-only file access
• No network calls, no external APIs
• Local processing only
• File paths validated (no ../ escapes)

External Endpoints

None. Purely local file → LLM → text.

Trust Statement

This skill reads local files and summarizes locally. No data leaves your machine.