My Summarize

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:38 AM UTC
• Version: 1.0.2

Overview

The skill is a straightforward summarization wrapper, but users should understand it installs an external CLI and may send summarized content to model or extraction services.

Install only if you trust the summarize CLI and its Homebrew tap. Do not summarize private or regulated files, private URLs, or media unless you are comfortable with the selected model provider and optional extraction services receiving that content; provide only the API key needed for the provider you intend to use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party Homebrew Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned third-party package from a mutable external source
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"clawdbot":{"emoji":"🧾","requires":{"bins":["summarize"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/summarize","bins":["summarize"],"label":"Install summarize (brew)"}]}}

Technical Analysis

The skill declares installation of the summarize executable from the third-party Homebrew tap steipete/tap. The dependency is not constrained to a specific version, immutable commit, or cryptographic checksum.

Because the project contains only documentation and metadata—not the Homebrew formula or the CLI source—the code ultimately installed and executed cannot be verified from the audited artifact. The effective package may change independently after this skill version has been reviewed. This creates a supply-chain trust boundary in which compromise of the tap, formula, release artifact, or associated maintainer account could cause future installations to retrieve altered code.

The CLI's documented purpose includes processing local files and using provider credentials such as OPENAI_API_KEY, ANTHROPIC_API_KEY, XAI_API_KEY, and GEMINI_API_KEY. Consequently, a malicious replacement could encounter sensitive file contents or credentials during ordinary use. No evidence establishes that the current upstream package is malicious; the confirmed issue is the mutable and unverified dependency declaration.

Attack Path

1. An attacker compromises the third-party Homebrew tap, its maintainer account, the referenced formula, or an artifact downloaded by that formula.
2. The attacker modifies the package or release so that installation or execution runs attacker-controlled code.
3. A user or agent installs steipete/tap/summarize through the skill's declared installation mechanism.
4. Homebrew resolves the unpinned formula to the ...[truncated 1189 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an immutable, audited release rather than relying on the mutable latest formula.
2. Verify downloaded artifacts using a trusted cryptographic checksum or signature.
3. Record the exact package version, source repository revision, and expected digest in the skill metadata or installation workflow.
4. Prefer an official and independently verifiable distribution channel over a third-party tap where one is available.
5. Review the Homebrew formula and all transitive download locations before approving installation.
6. Vendor the audited source or provide a reproducible build process where practical.
7. Run the CLI with least privilege and restrict its filesystem and network access to what the summarization task requires.
8. Provide only the API credential required for the selected provider and avoid exposing unrelated secrets in the process environment.
9. Repeat dependency review whenever the pinned version or verified digest changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly supports summarizing URLs, local files, PDFs, images, audio, and YouTube content via third-party model providers and optional fallback services, but it does not warn users that their supplied content may be transmitted off-host. This can lead to unintended disclosure of sensitive local file contents, private URLs, or media to external APIs, especially because the skill encourages use of provider API keys and optional Firecrawl/Apify integrations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.