ClawHub
Back to skill

Security audit

quick-summarize

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward summarizer that reads user-provided text, URLs, or files and does not show hidden or destructive behavior.

Install only if you are comfortable with the agent summarizing content you provide or point it to. Avoid asking it to summarize sensitive files or private URLs unless you intend that content to be read for the summary.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The README states the skill is 'automatically available when the agent determines summarization is needed,' which is an overly broad activation condition. In an agentic environment, vague auto-invocation can cause the skill to trigger on unintended inputs, leading to unnecessary processing of sensitive text, URLs, or files and expanding the skill’s access beyond clear user intent.

Static analysis

No suspicious patterns detected.