📝 文档摘要大师

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:26 AM UTC
• Version: 1.1.0

Overview

This summarization skill is purpose-aligned and locally scoped, with disclosed local storage but some privacy and accidental-activation considerations.

Before installing, be aware that the skill keeps local summary history and stats by default under ~/.openclaw/summarize-pro. Avoid using saved summaries or templates for highly sensitive material unless local retention is acceptable, and review/delete those files if needed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Session Persistence

Medium

• Category: Rogue Agent

Content

## First Run Setup

On first message, create data directory:

```bash
mkdir -p ~/.openclaw/summarize-pro

• Confidence: 90% confidence
• Finding: Creating a persistent data directory and initializing files on first message establishes session persistence automatically, even before the user expressly opts into storage. In this skill, that persistence is more dangerous because subsequent behavior includes auto-logging summaries, stats, and other user-derived data from potentially sensitive documents.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Generic triggers like "summary" and "summarize" are common in normal chat and can activate the skill without clear user intent to use this specific tool. In this skill, accidental activation is more concerning because it may auto-log content and update persistent history/stat files.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: Several listed triggers, such as broad conversational phrases and common task requests, overlap with routine assistant interactions. This increases the chance of unintended invocation and, in context, may lead to unnecessary processing and persistence of sensitive user content in history or saved files.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: Saving and displaying bookmarked summaries retains potentially sensitive excerpts and inferred topics beyond the original interaction. This increases the risk of later disclosure to anyone with local access or through subsequent assistant actions that enumerate saved content.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: Automatic logging of summaries and metadata creates retention of user-derived content that may include sensitive business, legal, medical, or personal information from uploaded documents. Even if stored locally, the history feature broadens exposure by making past content discoverable later and by persisting it beyond the immediate task.

Session Persistence

Medium

• Category: Rogue Agent

Content

## FEATURE 19: Custom Templates

When user says **"create template [name]"** or **"my templates"**:

Let users define their own summary format:

• Confidence: 84% confidence
• Finding: Custom templates are another form of session persistence that stores user-supplied content across interactions. While not inherently malicious, persisted templates can capture sensitive workflow terms or business structures and expand the amount of retained user data unnecessarily.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: Using the bare trigger phrase "help" is overly broad and likely to match ordinary conversation unrelated to summarization. That can cause unintended skill activation, which is risky here because the skill also reads and writes persistent local files and may log user-derived content automatically.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The initial settings specify "default_language": "english", which imposes a language default in the skill configuration. While the skill supports other languages, this default is not presented as a user choice at setup, so it may conflict with a language/locale preference policy requiring opt-in.

Scope Creep

Low

• Category: Excessive Agency

Content

When user says **"summarize in [language]"** or **"hindi mein summarize karo"**:

Supported languages include but not limited to:
Hindi, Spanish, French, German, Japanese, Chinese, Arabic, Portuguese, Italian, Korean, Russian, and more.

Summarize the content and output the summary IN the requested language.

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.