Summarize Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:43 AM UTC
• Version: 2.0.0

Overview

The skill itself is a document summarizer with no executable payload, but its install command points to a different package name than the reviewed package.

Review the package identity before installing. Do not follow the SKILL.md install command unless you confirm summarize-pro is the same reviewed package and publisher as huimai-summarizer; for legal or contract summaries, verify extracted terms against the source document.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:66

Finding

Mismatched Package Identifier in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 66-68
Vulnerability Type: Dependency confusion through an inconsistent package identifier
Risk Level: Medium

Vulnerable Code Snippet:

bash

clawhub install summarize-pro

The installation command references summarize-pro, while _meta.json identifies the audited project with the slug huimai-summarizer. This inconsistency can cause users to install a package other than the reviewed project.

Technical Analysis

Package installation instructions form part of the software supply chain. When the documented package identifier does not match the canonical project identifier, package resolution may target an unrelated registry entry. If summarize-pro is unregistered or controlled by another publisher, an attacker could register or update that package with malicious Skill instructions or executable components.

The repository contains no executable scripts, and the audit found no direct malicious behavior in the reviewed files. Exploitation therefore depends on the package registry resolving summarize-pro to content that differs from this audited project.

Attack Path

1. A user obtains and reviews this project as huimai-summarizer.
2. The user follows the installation instructions in SKILL.md.
3. The command requests the separate identifier summarize-pro.
4. The package registry resolves that identifier to an unrelated or attacker-controlled package.
5. The unintended package is installed and may be loaded under the user's trust in the reviewed project.
6. Any malicious instructions or executable components in that package operate with the permissions granted to the Skill runtime.

Impact Assessment

Successful exploitation could substitute unreviewed Skill content for the intended package. The resulting privileges are limited to those available to the Skill runtime and any tools or data the user authorizes. Depending on ...[truncated 252 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace summarize-pro with the verified canonical package slug recorded in _meta.json, if huimai-summarizer is the intended registry identifier.
2. Pin the installation command to a reviewed version rather than relying on an unqualified, mutable package reference.
3. Verify and document the expected publisher or owner identity alongside the package identifier.
4. Add an automated release check that rejects documentation when its installation target differs from the metadata slug.
5. Confirm ownership and contents of both registry identifiers before publishing corrected instructions.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill content is entirely Chinese and presents modes, guidance, and examples without offering a language-selection path, which can force a locale on users who may operate in other languages. In this context the risk is mainly usability and misinterpretation rather than direct security compromise, but misunderstanding in legal/contract summarization could still lead to user error.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description is phrased very broadly ('长文档、合同、文章扔进来，自动抽骨架') and can match common user requests in everyday conversation, increasing the chance of unintended invocation. This is not code-execution dangerous, but it can cause incorrect routing, accidental activation, or user confusion when normal chat is interpreted as a request to use the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.