ClawHub
Back to skill

Security audit

๐Ÿ“ ๆ–‡ๆกฃๆ‘˜่ฆๅคงๅธˆ

Security checks for vulnerabilities and agentic risk

Overview

This summarization skill is purpose-aligned and locally scoped, with disclosed local storage but some privacy and accidental-activation considerations.

Before installing, be aware that the skill keeps local summary history and stats by default under ~/.openclaw/summarize-pro. Avoid using saved summaries or templates for highly sensitive material unless local retention is acceptable, and review/delete those files if needed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

Creating a persistent data directory and initializing files on first message establishes session persistence automatically, even before the user expressly opts into storage. In this skill, that persistence is more dangerous because subsequent behavior includes auto-logging summaries, stats, and other user-derived data from potentially sensitive documents.

Content

Scanner excerpt ยท SKILL.md (reported line 46)May include surrounding context.

First Run Setup

On first message, create data directory:

bash
mkdir -p ~/.openclaw/summarize-pro

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Generic triggers like "summary" and "summarize" are common in normal chat and can activate the skill without clear user intent to use this specific tool. In this skill, accidental activation is more concerning because it may auto-log content and update persistent history/stat files.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

Several listed triggers, such as broad conversational phrases and common task requests, overlap with routine assistant interactions. This increases the chance of unintended invocation and, in context, may lead to unnecessary processing and persistence of sensitive user content in history or saved files.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Saving and displaying bookmarked summaries retains potentially sensitive excerpts and inferred topics beyond the original interaction. This increases the risk of later disclosure to anyone with local access or through subsequent assistant actions that enumerate saved content.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Automatic logging of summaries and metadata creates retention of user-derived content that may include sensitive business, legal, medical, or personal information from uploaded documents. Even if stored locally, the history feature broadens exposure by making past content discoverable later and by persisting it beyond the immediate task.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

Custom templates are another form of session persistence that stores user-supplied content across interactions. While not inherently malicious, persisted templates can capture sensitive workflow terms or business structures and expand the amount of retained user data unnecessarily.

Content

Scanner excerpt ยท SKILL.md (reported line 568)May include surrounding context.

md
## FEATURE 19: Custom Templates

When user says **"create template [name]"** or **"my templates"**:

Let users define their own summary format:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Using the bare trigger phrase "help" is overly broad and likely to match ordinary conversation unrelated to summarization. That can cause unintended skill activation, which is risky here because the skill also reads and writes persistent local files and may log user-derived content automatically.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The initial settings specify "default_language": "english", which imposes a language default in the skill configuration. While the skill supports other languages, this default is not presented as a user choice at setup, so it may conflict with a language/locale preference policy requiring opt-in.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt ยท SKILL.md (reported line 373)May include surrounding context.

md
When user says **"summarize in [language]"** or **"hindi mein summarize karo"**:

Supported languages include but not limited to:
Hindi, Spanish, French, German, Japanese, Chinese, Arabic, Portuguese, Italian, Korean, Russian, and more.

Summarize the content and output the summary IN the requested language.