skill-ts

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:50 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward wrapper for a summarization CLI, with expected external AI-provider use and a third-party install dependency that users should understand before using sensitive files.

Install only if you are comfortable trusting the third-party Homebrew tap and the configured AI/fallback providers. Avoid summarizing confidential local files, private URLs, or proprietary media unless your provider and workplace policies allow that data to be sent to external services.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party Homebrew Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned dependency from a third-party Homebrew tap
Risk Level: Medium

Vulnerable Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"🧾","requires":{"bins":["summarize"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/summarize","bins":["summarize"],"label":"Install summarize (brew)"}]}}

Technical Analysis

The installation metadata directs users or an automated agent to install the summarize executable from the third-party Homebrew tap steipete/tap. The dependency is not pinned to an immutable version or source commit, and the configuration provides no checksum or signature for integrity verification.

Consequently, the executable installed in the future may differ from the component that existed when this Skill was reviewed. This creates a supply-chain trust boundary: compromise of the tap, its maintainer account, its referenced release artifacts, or its distribution infrastructure could cause installation of attacker-controlled code.

No evidence indicates that the current dependency is malicious. The issue is the absence of controls ensuring that future installations retrieve the reviewed artifact.

Attack Path

1. An attacker compromises the third-party Homebrew tap, a maintainer account, or an upstream artifact referenced by its formula.
2. The attacker modifies the formula or release artifact to contain malicious installation logic or a malicious summarize executable.
3. A user or agent follows the Skill metadata and installs steipete/tap/summarize.
4. Homebrew retrieves and processes the modified formula or artifact because no immutable version, commit, checksum, or signature is enforced by this project.
5. Malicious code executes during installation or when the installed summarize command is subsequently invoked.

Impact Assessment

Successful exploitation could execute arbitr ...[truncated 512 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer an official, reviewed distribution channel rather than an unverified third-party tap.
• Pin the dependency to an immutable release version or source commit instead of tracking a mutable formula.
• Verify downloaded artifacts using a cryptographic checksum supplied through a trusted channel.
• Where supported, verify a cryptographic release signature and document the expected signing identity.
• Record the exact upstream repository and reviewed artifact so maintainers can reproduce and validate the installation.
• Execute installation and the resulting CLI with the least privileges necessary; do not install or run it as an administrator unless strictly required.
• Add routine dependency monitoring and re-audit the pinned artifact before approving version updates.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs users to provide URLs, local files, PDFs, images, audio, and YouTube links to a third-party summarization CLI, and it lists multiple external AI providers and optional fallback services. However, it does not warn that submitted content may be transmitted off-host to those providers, which can expose sensitive local files, internal URLs, or proprietary content without informed user consent.

Content

No source excerpt is available for this finding.