Summarize

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:49 AM UTC
• Version: 1.0.0

Overview

The skill is a straightforward wrapper for a summarization CLI, but users should understand it installs a third-party tool and may send summarized content to external providers.

Install only if you trust the summarize CLI distribution channel and are comfortable sending selected URLs, files, or media contents to the configured model or extraction providers. Avoid using it on sensitive, regulated, or private documents unless those provider transfers are approved.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Executable Installed from a Third-Party Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"clawdbot":{"emoji":"🧾","requires":{"bins":["summarize"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/summarize","bins":["summarize"],"label":"Install summarize (brew)"}]}}

Technical Analysis

The skill directs the environment to install the summarize executable from the third-party Homebrew tap steipete/tap. The dependency is not pinned to an immutable version, commit, artifact digest, or verified checksum.

Consequently, the executable installed in the future may differ from the dependency that existed when this skill was reviewed. If the tap, its maintainer account, its source repository, or its release pipeline is compromised, an attacker could replace the formula or referenced package with malicious code without modifying this skill package.

The project does not itself contain malicious scripts, and the audit found no evidence that the named dependency is currently malicious. The risk arises from the mutable and externally controlled dependency installation channel.

Attack Path

1. An attacker compromises the third-party Homebrew tap, its maintainer credentials, the associated source repository, or its release infrastructure.
2. The attacker modifies the summarize formula or an artifact referenced by that formula.
3. A user or agent follows the skill installation metadata and installs steipete/tap/summarize.
4. Homebrew retrieves and installs the attacker-controlled dependency.
5. When the skill invokes summarize, the malicious executable runs with the privileges and environment of the installing user.
6. The executable could access files available to that user, inspect inherited environment variables, misuse configured API credentials, alter user-owned files, or initiate outbound network connections.

Impact Assessment

Successf ...[truncated 770 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable third-party tap reference with a trusted official distribution channel where available.
2. Pin the dependency to a specific, reviewed release rather than installing the latest formula state.
3. Verify downloaded artifacts using a cryptographic SHA-256 checksum or a valid release signature before installation.
4. Where supported, reference an immutable source commit or versioned bottle whose digest is recorded in the installation configuration.
5. Document the dependency’s authoritative source repository and expected release provenance so users can independently verify it.
6. Add dependency monitoring and periodically re-audit the pinned release before upgrading.
7. Run the executable with least privilege and expose only the API credential required for the selected provider.
8. Avoid installing or invoking the dependency with administrative privileges unless explicitly required and separately justified.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill encourages users to summarize URLs, local files, and YouTube content while documenting multiple third-party model and extraction providers, but it does not warn that submitted content may be transmitted off-host to those external services. This can lead users to unintentionally send sensitive local documents, private URLs, or regulated data to external APIs, creating confidentiality and compliance risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.