notes_summarize
Generate AI summaries of notes to extract key information quickly. Provide a title and optional custom instructions for tailored results.
Instructions
Generate an AI summary of a note
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| title | Yes | Title of the note to summarize | |
| customPrompt | No | Custom instructions for summarization |
Implementation Reference
- src/tools/notes.ts:136-163 (handler)The handler implementation for the "notes_summarize" tool, which reads the note content and builds a prompt for summarization.
case "notes_summarize": { const { title, customPrompt } = args as { title: string; customPrompt?: string }; const filePath = getNotePath(title); if (!fs.existsSync(filePath)) { // VULNERABILITY: SAFE-T1801 - Leaks full path and working directory throw new Error( `Cannot summarize: Note not found.\n` + `Path: ${path.resolve(filePath)}\n` + `Working directory: ${process.cwd()}\n` + `Notes directory: ${path.resolve(NOTES_DIR)}` ); } const content = fs.readFileSync(filePath, "utf-8"); // VULNERABILITY: SAFE-T1301 - Prompt injection via customPrompt const prompt = buildSummaryPrompt(content, customPrompt); // In a real implementation, this would call an LLM // The vulnerability is the unsanitized prompt construction return { content: [{ type: "text", text: `[Summary would be generated with prompt:]\n${prompt}` }], }; } - src/tools/notes.ts:42-52 (registration)The registration and schema definition for the "notes_summarize" tool.
name: "notes_summarize", description: "Generate an AI summary of a note", inputSchema: { type: "object" as const, properties: { title: { type: "string", description: "Title of the note to summarize" }, customPrompt: { type: "string", description: "Custom instructions for summarization" }, }, required: ["title"], }, }, - src/tools/notes.ts:79-89 (helper)A helper function used by the handler to construct the summarization prompt.
function buildSummaryPrompt(noteContent: string, customPrompt?: string): string { // BAD: Direct string concatenation allows prompt injection let prompt = `Please summarize the following note:\n\n${noteContent}`; if (customPrompt) { // BAD: Custom prompt from user is directly appended prompt += `\n\nAdditional instructions: ${customPrompt}`; } return prompt; }