Summarize Tianjin

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:36 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it depends on an unpinned third-party CLI that may handle local files and API-key-backed content.

Review the upstream summarize CLI and Homebrew tap before installing. Do not run it on confidential, regulated, or private files or URLs unless you accept that their contents may be processed by the selected model provider and any enabled fallback service. Use only the API key required for the provider you choose.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Executable Installed from a Third-Party Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"🧾","requires":{"bins":["summarize"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/summarize","bins":["summarize"],"label":"Install summarize (brew)"}]}}

Technical Analysis

The skill declares steipete/tap/summarize as an installation source for the required summarize executable. This is a third-party Homebrew tap rather than an artifact whose implementation is included in the audited project.

The dependency declaration does not pin an immutable package version, source commit, or cryptographic checksum. Consequently, the executable installed in the future may differ from the version intended or reviewed when the skill was published. Because the audited artifact contains only documentation and metadata, the behavior of the installed executable cannot be verified from this project.

This creates a supply-chain trust boundary: compromise of the tap, formula, upstream release location, or maintainer account could cause Homebrew to install attacker-controlled code. The skill also documents API-key environment variables and processing of local files, increasing the sensitivity of information potentially accessible to a compromised executable.

Attack Path

1. An attacker compromises the third-party Homebrew tap, its maintainer account, the referenced upstream artifact, or another component of its distribution chain.
2. The attacker changes the formula or distributed package so that it installs a malicious summarize executable.
3. A user or agent follows the skill metadata and installs steipete/tap/summarize.
4. The malicious executable runs with the privileges of the user invoking Homebrew or the CLI.
5. When invoked, it could read files explicitly supplied for summarization, inspect environment varia ...[truncated 1140 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the third-party tap with an official, reviewed package source where one is available.
2. Pin the dependency to an immutable release version or source commit rather than relying on a mutable formula reference.
3. Verify downloaded artifacts using a documented SHA-256 checksum or a validated cryptographic signature.
4. Record the upstream source repository and reviewed release in the skill metadata so auditors can trace the installed implementation.
5. Require explicit user approval before installing external executable dependencies.
6. Run the CLI with least privilege and avoid invoking Homebrew or the executable with administrative privileges.
7. Provide only the API key required for the selected provider, preferably through a scoped and short-lived credential.
8. Isolate processing of sensitive files, restrict outbound network access where practical, and review dependency updates before adoption.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly supports summarizing URLs, local files, and YouTube links using third-party model providers, and also documents fallback services such as Firecrawl and Apify. Without a clear user-facing warning, users may unintentionally send sensitive local documents, private URLs, or extracted content to external services, creating confidentiality and data-handling risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.