Summarize 1.0.0

Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube).

Security Scan

The skill is an instruction-only wrapper around a CLI named 'summarize' and its declared requirements and usage are consistent with the stated purpose, though there are a few minor inconsistencies you should be aware of.

Purpose & Capability

The skill's name/description (summarize URLs/files/YouTube) matches the declared required binary 'summarize' and the install step (brew formula steipete/tap/summarize). Asking for model API keys (OpenAI, Anthropic, XAI, Google) is coherent with a summarization CLI that calls LLM providers.

Instruction Scope

SKILL.md confines runtime behavior to invoking the summarize CLI on URLs and local files and documents optional config path (~/.summarize/config.json). It references several environment variables and optional tokens (FIRECRAWL_API_KEY, APIFY_API_TOKEN) the agent or user may set. The instructions do not themselves tell the agent to read arbitrary system files or exfiltrate data outside of the model/provider endpoints, but they do rely on external services for content extraction when configured.

Install Mechanism

Install uses a Homebrew formula from a third-party tap (steipete/tap). Homebrew is a common install route, but third-party taps are less vetted than the official homebrew/core; this is moderate-risk compared with no install or an official package.

Credentials

Registry metadata lists no required env vars, but SKILL.md documents multiple provider API keys and optional service tokens. Those keys are reasonable and expected for a multi-provider summarization CLI, but the skill does reference env vars and a config path that were not declared as required—this mismatch should be noted before installation.

Persistence & Privilege

always is false and the skill does not request persistent/privileged platform presence or modifications to other skills. The only persistence implied is the optional config file at ~/.summarize/config.json which is normal for CLI tools.

Assessment

This skill is an instruction wrapper around a CLI named 'summarize' and appears internally consistent. Before installing: (1) verify the Homebrew tap (steipete/tap) and the summarize project/homepage (https://summarize.sh or its source repo) to ensure you trust the publisher; (2) be aware that the tool can send content to LLM providers — only supply API keys you trust and are scoped appropriately (prefer limited-scope keys); (3) check the ~/.summarize/config.json file if it will store API keys or outputs and ensure it has appropriate filesystem permissions; (4) optional third-party tokens (APIFY, FIRECRAWL) enable external extraction services — only provide them if you trust those services; (5) if you want higher assurance, inspect the brew formula or upstream source code for network endpoints and data handling before installing.

Summarize

Fast CLI to summarize URLs, local files, and YouTube links.

Quick start

summarize "https://example.com" --model google/gemini-3-flash-preview
summarize "/path/to/file.pdf" --model google/gemini-3-flash-preview
summarize "https://youtu.be/dQw4w9WgXcQ" --youtube auto

Model + keys

Set the API key for your chosen provider:

• OpenAI: OPENAI_API_KEY
• Anthropic: ANTHROPIC_API_KEY
• xAI: XAI_API_KEY
• Google: GEMINI_API_KEY (aliases: GOOGLE_GENERATIVE_AI_API_KEY, GOOGLE_API_KEY)

Default model is google/gemini-3-flash-preview if none is set.

Useful flags

• --length short|medium|long|xl|xxl|<chars>
• --max-output-tokens <count>
• --extract-only (URLs only)
• --json (machine readable)
• --firecrawl auto|off|always (fallback extraction)
• --youtube auto (Apify fallback if APIFY_API_TOKEN set)

Config

Optional config file: ~/.summarize/config.json

{ "model": "openai/gpt-5.2" }

Optional services:

• FIRECRAWL_API_KEY for blocked sites
• APIFY_API_TOKEN for YouTube fallback