test-0313-skill

Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube).

Security Scan

The skill is internally consistent: it wraps a CLI named 'summarize' (installable from a Homebrew tap) to summarize URLs and local files and only asks for the kinds of API keys you would expect for LLM providers or optional extraction services.

Purpose & Capability

Name/description, required binary ('summarize'), and the brew install formula steipete/tap/summarize align with the stated purpose of summarizing URLs, local files, YouTube, and other media. No unrelated binaries or credentials are requested.

Instruction Scope

SKILL.md instructs the agent to run the summarize CLI on URLs or local files and documents relevant flags, optional config (~/.summarize/config.json), and optional API keys for model providers and fallback extractors. The instructions do not ask the agent to read arbitrary unrelated system files or to exfiltrate unrelated secrets. Note: running the CLI will send the supplied content to whatever model/extraction services you configure (OpenAI/Anthropic/XAI/Google, Apify/Firecrawl) — expected for this functionality.

Install Mechanism

Install is via a Homebrew formula (steipete/tap/summarize). Using a third‑party Homebrew tap is a normal distribution method for CLI tools but is not as tightly vetted as Homebrew/core; the tap will download and install code on the host. There is no direct URL download or archive extraction in the skill metadata.

Credentials

The SKILL.md mentions provider API keys (OPENAI_API_KEY, ANTHROPIC_API_KEY, XAI_API_KEY, GEMINI_API_KEY, plus optional FIRECRAWL_API_KEY and APIFY_API_TOKEN). These are appropriate and proportional to a summarization CLI that supports multiple LLM backends and fallback extractors. None are marked required by the skill metadata (they are optional depending on usage).

Persistence & Privilege

The skill does not request always:true, does not declare persistent system-wide changes, and is user-invocable. It does not ask to modify other skills or system configurations beyond optional per-user config (~/.summarize/config.json).

Assessment

This skill is coherent with its description, but before installing: 1) verify you trust the Homebrew tap (steipete) since installing a third‑party formula will run code on your machine; review the tap/formula if possible. 2) Be aware that any URL or local file you pass to summarize will be sent to the configured model/extraction provider (OpenAI/Anthropic/XAI/Google/Apify/Firecrawl), so avoid sending sensitive secrets or private files unless you trust that provider and the CLI. 3) If you want stronger isolation, run the CLI inside a sandbox or VM and inspect ~/.summarize/config.json for stored settings. 4) If you need more assurance, request the formula source or a package checksum before installing.

Summarize

Fast CLI to summarize URLs, local files, and YouTube links.

Quick start

summarize "https://example.com" --model google/gemini-3-flash-preview
summarize "/path/to/file.pdf" --model google/gemini-3-flash-preview
summarize "https://youtu.be/dQw4w9WgXcQ" --youtube auto

Model + keys

Set the API key for your chosen provider:

• OpenAI: OPENAI_API_KEY
• Anthropic: ANTHROPIC_API_KEY
• xAI: XAI_API_KEY
• Google: GEMINI_API_KEY (aliases: GOOGLE_GENERATIVE_AI_API_KEY, GOOGLE_API_KEY)

Default model is google/gemini-3-flash-preview if none is set.

Useful flags

• --length short|medium|long|xl|xxl|<chars>
• --max-output-tokens <count>
• --extract-only (URLs only)
• --json (machine readable)
• --firecrawl auto|off|always (fallback extraction)
• --youtube auto (Apify fallback if APIFY_API_TOKEN set)

Config

Optional config file: ~/.summarize/config.json

{ "model": "openai/gpt-5.2" }

Optional services:

• FIRECRAWL_API_KEY for blocked sites
• APIFY_API_TOKEN for YouTube fallback