Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward summarization skill, but users should remember that URLs, files, and transcripts may be processed by external AI and extraction services.
Install only if you are comfortable sending the URLs, file contents, or transcript text you ask it to summarize to the selected model provider, and potentially to Firecrawl or Apify when those fallback options or tokens are enabled. Avoid using it on confidential documents or private/authenticated links unless that data sharing is acceptable.
The skill description and usage guidance do not warn users that supplied URLs, transcripts, and local file contents may be transmitted to external model providers. This omission can lead users to share sensitive documents or private links without informed consent, creating confidentiality and compliance risks.
The trigger phrases include very generic requests like asking what a link or video is about, which can cause the skill to auto-activate in many ordinary contexts. Because this skill sends URLs or local files to an external summarization tool and potentially third-party fallback services, over-broad matching increases the chance of unintended data handling and disclosure.
The documented fallback services Firecrawl and Apify are third-party processors, but the skill does not disclose that enabling them may send fetched page content or YouTube-related data outside the primary toolchain. Users may unknowingly expose private or regulated data to additional vendors, expanding the attack surface and data-sharing footprint.
No suspicious patterns detected.
