test-summary

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:52 AM UTC
• Version: 0.0.1

Overview

This skill is a straightforward wrapper for a summarization CLI, with ordinary privacy and supply-chain cautions for external APIs and a Homebrew-installed tool.

Before installing, treat this as a third-party CLI that can send selected content to model and extraction providers. Avoid using it on secrets, regulated data, or internal documents unless those providers are approved, and consider reviewing or pinning the Homebrew package source in sensitive environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party Homebrew Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Supply-chain risk from an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"🧾","requires":{"bins":["summarize"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/summarize","bins":["summarize"],"label":"Install summarize (brew)"}]}}

Technical Analysis

The skill instructs users to install the summarize executable from the third-party Homebrew tap steipete/tap. The dependency declaration does not pin a reviewed version, commit, package digest, or checksum. Consequently, the artifact installed in the future can differ from the artifact that existed when this skill was reviewed.

This does not establish that the current package is malicious. However, it creates a supply-chain trust boundary outside the audited project: compromise of the tap, formula repository, release infrastructure, or maintainer account could replace the expected package with attacker-controlled content.

Attack Path

1. An attacker compromises the third-party tap, its maintainer account, formula repository, or referenced release artifact.
2. The attacker changes the formula or distributed package to install a malicious summarize executable.
3. A user follows the skill installation metadata and installs steipete/tap/summarize.
4. Homebrew retrieves and installs the modified dependency because the skill does not constrain it to a reviewed version and integrity value.
5. When the user or agent invokes summarize, the malicious executable runs with the privileges and environmental access of that user.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the account performing installation or invoking the CLI. Depending on that account's permissions and environment, the malicious package could access local files, API keys exposed ...[truncated 257 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specific, reviewed release rather than relying on the mutable latest formula.
• Verify the downloaded artifact with a cryptographic checksum or signature obtained through a trusted channel.
• Prefer an official or otherwise strongly trusted distribution source with documented release provenance.
• Record the reviewed version, source repository, expected digest, and verification procedure in the skill documentation.
• Use reproducible builds or package attestations where available.
• Periodically re-audit dependency updates before changing the pinned version.
• Run the CLI with least privilege and expose only the provider credentials and files required for the current operation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly encourages summarizing URLs, local files, PDFs, images, audio, and YouTube content while documenting multiple third-party model and extraction providers, but it does not warn users that submitted content may be transmitted off-host to those services. This can lead users to unknowingly send sensitive local documents, private URLs, or regulated data to external providers such as model APIs, Firecrawl, or Apify.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.