Summarize XHS

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:18 AM UTC
• Version: 1.0.0

Overview

This is a coherent summarization skill, but it relies on an unpinned third-party CLI and does not clearly explain where submitted content may be sent.

Review this before installing if you may summarize confidential documents, private URLs, or regulated data. Use narrowly scoped API keys, understand which provider or fallback service is active, and prefer a pinned or otherwise verifiable install source for the summarize binary.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Unpinned Executable Installation from a Third-Party Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 7
Vulnerability Type: Unpinned third-party dependency installed from an external package source
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"clawdbot":{"emoji":"🧾","requires":{"bins":["summarize"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/summarize","bins":["summarize"],"label":"Install summarize (brew)"}]}}

Technical Analysis

The Skill directs the host to install the summarize executable from the third-party Homebrew tap steipete/tap without specifying an immutable release, commit, package checksum, or signature-verification requirement.

Consequently, the executable installed at deployment time may differ from the implementation that existed when this Skill was reviewed. The executable's source code is not included in the audited artifact, which contains only SKILL.md and _meta.json; therefore, its handling of local files, API credentials, remote requests, and command execution cannot be independently verified from this package.

This creates a supply-chain trust boundary. If the tap, formula repository, release infrastructure, or maintainer account is compromised, the mutable formula could distribute an attacker-controlled executable while preserving the expected package and binary names.

Attack Path

1. An attacker compromises the third-party Homebrew tap, its maintainer account, or an artifact location referenced by its formula.
2. The attacker changes the formula or distributed package so that it installs a malicious executable named summarize.
3. A user installs the Skill dependency through the declared Homebrew installation mechanism.
4. Homebrew resolves the mutable third-party formula and installs the compromised package without validation against a checksum or revision defined by this Skill.
5. The user or agent invokes summarize as documented.
6. The malicious executable runs with the privileges of the invoking user an ...[truncated 706 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an immutable and reviewed release, formula revision, or source commit rather than relying only on the mutable name steipete/tap/summarize.
2. Record and verify a cryptographic checksum for the exact downloaded artifact before installation or execution.
3. Require signed releases and validate signatures against a documented, trusted maintainer key where supported.
4. Prefer a trusted package source with reproducible builds and transparent release provenance.
5. Include the executable's source code or a verifiable source reference in the Skill package so its runtime behavior can be audited.
6. Document the exact package version and update it only through a review process that examines dependency changes.
7. Run the executable with least privilege and restrict its access to unrelated files, credentials, and network destinations where practical.
8. Avoid exposing unnecessary API keys in the execution environment and use narrowly scoped credentials for optional external services.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises summarization of URLs, local files, PDFs, images, audio, and YouTube content while instructing users to provide API keys for external model providers, but it does not clearly warn that submitted content may be transmitted to third-party services. This creates a real data exposure risk because users may upload sensitive local files or private URLs under the assumption processing is local or self-contained.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill lists optional fallback services such as Firecrawl and Apify but does not disclose that enabling these services can send user content or fetched content to additional third-party processors beyond the primary LLM provider. This omission increases the chance of unintentional data sharing and undermines informed consent, especially for blocked sites, YouTube processing, and extracted content workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.