Claw Summarize Pro

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:59 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward summarization CLI wrapper, with a disclosed but unpinned third-party Homebrew install dependency.

Install only if you trust the summarize CLI and its Homebrew tap. Use narrowly scoped API keys where possible, avoid summarizing highly sensitive local files unless needed, and review the upstream CLI source or release provenance if supply-chain assurance matters to you.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party Executable Dependency from a Custom Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code Snippet

yaml

metadata: {"clawdbot":{"emoji":"🧾","requires":{"bins":["summarize"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/summarize","bins":["summarize"],"label":"Install summarize (brew)"}]}}

Technical Analysis

The skill delegates installation of the required summarize executable to the custom Homebrew tap steipete/tap without specifying an immutable version, source commit, checksum, or cryptographic signature.

Consequently, the installed executable may change after this skill package has been reviewed. The artifact contains no source code for the CLI, so its implementation and runtime handling of files, environment variables, and network requests cannot be independently audited from the project.

This creates a supply-chain risk: compromise of the referenced tap, its upstream release infrastructure, or the formula could cause subsequent installations to retrieve a modified executable.

Attack Path

1. An attacker compromises the custom Homebrew tap, its maintainer account, or an upstream artifact referenced by the formula.
2. The attacker modifies the formula or release artifact to distribute a malicious summarize executable.
3. A user installs the dependency using the skill's documented installation metadata.
4. Homebrew retrieves and installs the attacker-controlled executable because no immutable version or independently verified digest is specified by the skill.
5. When the skill invokes summarize, the malicious executable runs with the privileges of the invoking user.
6. The executable may access supplied local files, readable environment variables, or configured credentials and transmit them to an attacker-controlled service.

Impact Assessment

Successful exploitation would provide code execution with the privileges of the user ...[truncated 690 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an immutable, reviewed version or source commit rather than relying on a mutable formula reference.
2. Verify downloaded release artifacts against a trusted SHA-256 digest and, where available, a maintainer signature.
3. Document the exact upstream repository, release version, and expected artifact checksum.
4. Prefer a trusted package source with transparent provenance, reproducible builds, and signed releases.
5. Include the dependency's auditable source or a reproducible build procedure with the skill.
6. Run the CLI with least privilege and restrict its access to only the files required for each summarization task.
7. Provide only the credentials required for the selected provider, using a restricted process environment and narrowly scoped API keys.
8. Review dependency updates before changing the pinned version, and automate integrity and provenance verification in the release process.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.