Summarize Backup

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 2:06 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward summarization wrapper, but users should understand that local files or URLs may be processed by external providers and that the CLI is installed from a third-party Homebrew tap.

Install only if you are comfortable using the third-party summarize CLI and its Homebrew tap. Do not summarize confidential files, private URLs, or sensitive media unless the chosen model provider and optional extraction services are approved for that data. Prefer scoped API keys and review the Homebrew formula/source before use in higher-trust environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party Homebrew Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned dependency from a third-party Homebrew tap
Risk Level: Medium

Vulnerable Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"🧾","requires":{"bins":["summarize"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/summarize","bins":["summarize"],"label":"Install summarize (brew)"}]}}

Technical Analysis

The skill declares steipete/tap/summarize as an installation source without specifying an immutable package version, repository commit, checksum, or cryptographic signature. The package implementation is not included in the audited artifact, which contains only SKILL.md and _meta.json. Consequently, the effective code installed and executed by users can change after this skill has been reviewed.

This creates a supply-chain trust boundary: control of the third-party tap, its formula, or an associated release artifact could allow modified installation or runtime code to be distributed under the expected package name. The audit found no evidence that the current dependency is malicious; the vulnerability is the mutable and unverifiable dependency reference.

Attack Path

1. An attacker compromises the third-party Homebrew tap, a maintainer account, the formula repository, or an artifact referenced by the formula.
2. The attacker modifies the formula or its downloadable package to contain malicious installation or runtime behavior.
3. A user or agent follows the skill metadata and installs steipete/tap/summarize.
4. Homebrew retrieves the attacker-controlled version because the skill does not constrain installation to a reviewed immutable revision.
5. Malicious code executes during installation or when the summarize command is invoked.
6. The code accesses data available to the installing user, potentially including local documents submitted for summarization, environment-based API credentials ...[truncated 547 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed, immutable release and repository commit rather than a mutable formula reference.
2. Verify downloaded artifacts using a published cryptographic checksum or signature.
3. Record the authoritative source repository and expected package digest in the skill documentation.
4. Review the Homebrew formula and all transitive installation sources before approving the skill.
5. Prefer vendored or otherwise reproducibly built source when feasible, with a lock file or equivalent integrity metadata.
6. Run the CLI with least privilege and restrict access to sensitive files and unrelated environment variables.
7. Avoid exposing provider credentials globally; use narrowly scoped keys and rotate them if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly encourages summarizing URLs, local files, PDFs, images, audio, and YouTube content using third-party model providers and optional fallback services, but it does not warn users that the referenced content may be transmitted off-host. This creates a real data exposure risk because users may summarize sensitive local files or private URLs without understanding that their contents could be sent to external APIs such as Google, OpenAI, Anthropic, Firecrawl, Apify, or xAI.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.