Summarize Pro 1.0.0

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:35 PM UTC
• Version:
  1.0.0

Overview

This is a coherent local summarizer skill, with a small accidental-activation and local-history privacy risk users should understand.

Install if you want a local summarizer that can keep preferences, stats, saved summaries, templates, and recent summary history under ~/.openclaw/summarize-pro/. Avoid using it on highly sensitive material unless you are comfortable with local metadata being recorded, and periodically review or clear that directory if needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The activation conditions are very broad and include common terms like 'summary', 'help', 'compare', and generic meeting/email phrases. This can cause the skill to activate in unintended contexts, potentially intercepting unrelated user requests and triggering file reads/writes or persistent logging when the user did not explicitly intend to use this skill.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: Including a standalone 'help' trigger is especially risky because it is a ubiquitous phrase likely to appear across many unrelated interactions. This can cause the summarizer skill to hijack general assistance requests and expose management functions such as history, saved summaries, or template handling outside the user's intended context.

VirusTotal

64/64 vendors flagged this skill as clean.