Summarize 1.0.0

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:51 AM UTC
• Version: 1.0.0

Overview

The skill is a straightforward summarization helper, but users should know it installs a third-party CLI and may send selected content to model or extraction services.

Install only if you trust the steipete Homebrew tap and the model or extraction services you configure. Do not summarize secrets, confidential files, or private URLs unless you are comfortable with that content being handled by the selected external providers.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party Executable Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned executable from a third-party Homebrew tap
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"clawdbot":{"emoji":"🧾","requires":{"bins":["summarize"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/summarize","bins":["summarize"],"label":"Install summarize (brew)"}]}}

Technical Analysis

The skill directs the environment to obtain the summarize executable from the third-party Homebrew tap steipete/tap. The dependency declaration does not pin an immutable package version, source commit, artifact digest, or checksum. The executable's implementation is also not included in the audited project.

Consequently, the code ultimately installed can change after this skill has been reviewed. This creates a supply-chain trust boundary: compromise of the tap, its release infrastructure, or an upstream artifact could cause users to install code different from the code originally intended or assessed.

No evidence in the supplied files establishes that the current package is malicious. The issue is the absence of controls that guarantee dependency provenance and immutability.

Attack Path

1. An attacker compromises the third-party tap, its maintainer account, release infrastructure, or an artifact referenced by its formula.
2. The attacker modifies the formula or published package so that it installs a malicious summarize executable.
3. A user or agent processes the skill's installation metadata and installs steipete/tap/summarize.
4. Homebrew retrieves the attacker-controlled formula or artifact because no immutable version and verified digest are specified by the skill.
5. The malicious executable runs during installation or when the skill invokes summarize.
6. It can access resources available to the invoking account, potentially including selected local files, provider API keys, configuration files, and network connectivity. ...[truncated 547 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an immutable, reviewed version rather than a mutable formula reference.
2. Verify downloaded artifacts with a cryptographic checksum or signature tied to that version.
3. Pin the tap or source repository to a reviewed commit where supported.
4. Prefer a trusted official package registry or distribution channel with provenance and signing controls.
5. Document the exact upstream source, version, artifact digest, and verification procedure.
6. Audit or vendor the executable's source when the deployment's threat model requires reproducible review.
7. Run the CLI with least privilege in a sandbox that exposes only the specific input file required for summarization.
8. Restrict environment variables and credentials provided to the process, and use narrowly scoped, revocable API keys.
9. Add automated dependency monitoring and require security review before updating the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly supports summarizing URLs, local files, and YouTube content using external model providers and optional third-party services, but it does not warn users that submitted content may be transmitted off-host. This creates a real privacy and data-handling risk because users may pass sensitive local files or private URLs under the assumption processing is local.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.