Summarize

Summarize or extract text/transcripts from URLs, podcasts, and local files (great fallback for “transcribe this YouTube/video”).

Security Scan

The skill's declared purpose (summarizing URLs/local files/YouTube) matches what the instructions require (a 'summarize' CLI and optional provider API keys); the main issues are a minor metadata mismatch and that the brew formula is from a third‑party tap which you may want to review before installing.

Purpose & Capability

The name/description (summarize URLs, local files, YouTube) aligns with the declared runtime requirement of a 'summarize' binary and the CLI examples. The listed provider API keys (OPENAI_API_KEY, ANTHROPIC_API_KEY, GEMINI_API_KEY/XAI_API_KEY) and optional service keys (FIRECRAWL_API_KEY, APIFY_API_TOKEN) are coherent with a tool that fetches content and uses external LLMs or crawling fallbacks. One inconsistency: the registry metadata states 'Required env vars: none' while SKILL.md documents multiple env vars the CLI can use (these are optional, but the metadata omission is misleading).

Instruction Scope

SKILL.md contains concrete CLI usage examples, flags, and a single optional config path (~/.summarize/config.json). It instructs the agent to run the summarize binary against URLs and local files (expected). It does not instruct broad system file reads beyond the optional config path, nor does it ask to exfiltrate data to unexpected endpoints. It does reference external services/APIs (LLM providers, Firecrawl, Apify) which is expected for this use case.

Install Mechanism

Install uses Homebrew with formula steipete/tap/summarize. Using brew is reasonable, but the formula comes from a third‑party tap rather than an official core tap. That increases the need to review the formula/source before installing because brew will download and install code from that tap.

Credentials

The skill documents multiple API keys for various LLM/cloud providers and optional crawl services. Those are proportionate to a summarization/transcription tool that can use different backends. However, the skill metadata did not declare these env vars as required, which is an inconsistency that could confuse non-technical users about what secrets they must provide.

Persistence & Privilege

The skill is not always-enabled and does not request elevated or persistent platform privileges. It uses an optional config file under the user's home directory (~/.summarize/config.json), which is appropriate for user-scoped configuration.

Assessment

This skill appears to do what it says, but review a few items before installing: (1) Inspect the Homebrew formula in steipete/tap to see what the package installs and where it fetches code from (third‑party taps are higher risk than official taps). (2) Only set API keys you trust and scope them appropriately — the CLI will use your provider keys to send content to external LLMs. (3) Check and secure the optional config file (~/.summarize/config.json) so it doesn't store secrets in plaintext or with wide permissions. (4) If you need higher assurance, run the binary in a sandbox or container the first time and monitor network activity to confirm it only accesses expected endpoints (LLM providers, crawl services) and not unrelated services.

Fast CLI to summarize URLs, local files, and YouTube links.

When to use (trigger phrases)

Use this skill immediately when the user asks any of:

• “use summarize.sh”
• “what’s this link/video about?”
• “summarize this URL/article”
• “transcribe this YouTube/video” (best-effort transcript extraction; no yt-dlp needed)

Quick start

summarize "https://example.com" --model google/gemini-3-flash-preview
summarize "/path/to/file.pdf" --model google/gemini-3-flash-preview
summarize "https://youtu.be/dQw4w9WgXcQ" --youtube auto

YouTube: summary vs transcript

Best-effort transcript (URLs only):

summarize "https://youtu.be/dQw4w9WgXcQ" --youtube auto --extract-only

If the user asked for a transcript but it’s huge, return a tight summary first, then ask which section/time range to expand.

Model + keys

Set the API key for your chosen provider:

• OpenAI: OPENAI_API_KEY
• Anthropic: ANTHROPIC_API_KEY
• xAI: XAI_API_KEY
• Google: GEMINI_API_KEY (aliases: GOOGLE_GENERATIVE_AI_API_KEY, GOOGLE_API_KEY)

Default model is google/gemini-3-flash-preview if none is set.

Useful flags

• --length short|medium|long|xl|xxl|<chars>
• --max-output-tokens <count>
• --extract-only (URLs only)
• --json (machine readable)
• --firecrawl auto|off|always (fallback extraction)
• --youtube auto (Apify fallback if APIFY_API_TOKEN set)

Config

Optional config file: ~/.summarize/config.json

{ "model": "openai/gpt-5.2" }

Optional services:

• FIRECRAWL_API_KEY for blocked sites
• APIFY_API_TOKEN for YouTube fallback