Summarize Tianjin

Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube).

Security Scan

The skill is internally consistent: it is an instruction-only wrapper that expects the 'summarize' CLI (installed via a Homebrew tap) and documents the API keys and config the CLI may use — nothing in the skill itself requests unrelated credentials or escalated privileges.

Purpose & Capability

The name/description (summarize URLs/files) matches the declared requirement (summarize binary) and the install (Homebrew formula steipete/tap/summarize). The CLI is the logical thing to require.

Instruction Scope

SKILL.md tells the agent to run the summarize CLI against URLs, local files, and YouTube links. This is expected, but be aware summarizing local files will cause the CLI to read user files and the CLI will likely send content to remote model providers (OpenAI/Anthropic/Google/xAI) when API keys are set. The README also references optional FIRECRAWL/APIFY tokens for extraction fallbacks.

Install Mechanism

Install uses a third-party Homebrew tap (steipete/tap) which is a common but external distribution mechanism; brew installs are lower-risk than arbitrary downloads but you should review the tap/formula source before installing to confirm trustworthiness.

Credentials

The skill declares no required env vars and only documents standard provider API keys and optional tokens (OPENAI_API_KEY, ANTHROPIC_API_KEY, GEMINI_API_KEY, XAI_API_KEY, FIRECRAWL_API_KEY, APIFY_API_TOKEN). These map to the described functionality and are proportionate.

Persistence & Privilege

The skill does not request always:true or any special persistent privileges. It's user-invocable and relies on an external CLI; no indication it modifies other skills or system-wide settings.

Assessment

This skill is a small wrapper that expects you to install a third‑party CLI via a Homebrew tap. Before installing: (1) verify the Homebrew tap/formula source (steipete/tap) on GitHub to ensure the binary is from a trusted maintainer; (2) remember that running the CLI on local files will cause content to be read and (typically) sent to remote model providers — avoid summarizing sensitive secrets unless you trust the provider and key scope; (3) keep API keys out of shared environments and prefer scoped keys; (4) inspect or sandbox the binary if you need higher assurance. Note: the bundled _meta.json ownerId differs from the registry metadata ownerId — this metadata mismatch is not necessarily malicious but is worth checking (could indicate repackaging).

Summarize

Fast CLI to summarize URLs, local files, and YouTube links.

Quick start

summarize "https://example.com" --model google/gemini-3-flash-preview
summarize "/path/to/file.pdf" --model google/gemini-3-flash-preview
summarize "https://youtu.be/dQw4w9WgXcQ" --youtube auto

Model + keys

Set the API key for your chosen provider:

• OpenAI: OPENAI_API_KEY
• Anthropic: ANTHROPIC_API_KEY
• xAI: XAI_API_KEY
• Google: GEMINI_API_KEY (aliases: GOOGLE_GENERATIVE_AI_API_KEY, GOOGLE_API_KEY)

Default model is google/gemini-3-flash-preview if none is set.

Useful flags

• --length short|medium|long|xl|xxl|<chars>
• --max-output-tokens <count>
• --extract-only (URLs only)
• --json (machine readable)
• --firecrawl auto|off|always (fallback extraction)
• --youtube auto (Apify fallback if APIFY_API_TOKEN set)

Config

Optional config file: ~/.summarize/config.json

{ "model": "openai/gpt-5.2" }

Optional services:

• FIRECRAWL_API_KEY for blocked sites
• APIFY_API_TOKEN for YouTube fallback