Summarize File

Reads text files from workspace/paths and generates concise summaries. Handles logs, reports, CSVs, multi-line content.

Do not install or enable this skill without changes. The code does not match the skill description: it reads a hard-coded Windows path using fs rather than the platform workspace.read API, performs no path validation (risk of reading files outside the workspace), and does not implement any LLM summarization — it just returns the first 500 characters. If you want to proceed, ask the author to (1) remove hard-coded absolute paths and use the declared workspace.read API, (2) add robust path normalization and enforce that files stay inside the workspace (no ../ traversal), (3) implement the actual summarization logic (or clearly document why it only returns an excerpt), and (4) make it cross-platform. Until these changes are made, run the skill only in an isolated environment and inspect/approve the source yourself.

Type: OpenClaw Skill Name: summarize-file Version: 1.0.0 The skill contains a critical path traversal vulnerability in `index.js`. The `filename` parameter is directly concatenated into the file path without any sanitization, allowing an attacker to read arbitrary files outside the intended `workspace` directory (e.g., `../../../../etc/passwd`). This directly contradicts the `SKILL.md` documentation's claim of 'File paths validated (no ../ escapes)'. While the skill's core logic only reads and truncates the file content, this vulnerability allows unauthorized access to sensitive system files, making it a high-risk flaw.