skill-0331-02

Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube).

Security Scan

The skill is internally consistent: it is an instruction-only wrapper that calls a summarize CLI, and the requested/install items align with its stated purpose.

Purpose & Capability

Name/description match the actual requirements: the skill expects a 'summarize' CLI and offers flags for model providers and fallbacks. There are no unrelated required binaries or unexplained credentials in the manifest.

Instruction Scope

SKILL.md instructs the agent to run the summarize CLI on URLs, files, and YouTube links and to use provider API keys when set. This is within scope, but using the skill will send content to external model providers and optional services (Firecrawl, Apify) — the doc explicitly references those keys/configs, so data transmission to third-party APIs is expected behavior.

Install Mechanism

Install is a Homebrew formula (steipete/tap/summarize). Homebrew is a standard mechanism, but this is a third-party tap rather than an official core formula — users should review the tap/formula source before installing.

Credentials

The manifest doesn't require any environment variables. SKILL.md documents optional API keys (OpenAI, Anthropic, xAI, Google, FIRECRAWL_API_KEY, APIFY_API_TOKEN) that are appropriate for a tool that forwards content to model providers or external extraction services; no unrelated credentials are requested.

Persistence & Privilege

The skill does not request always:true or other elevated persistence. It's user-invocable and relies on an external binary — no evidence it modifies other skills or system-wide settings.

Assessment

This skill is coherent but still requires caution: 1) it relies on an external binary from a third-party Homebrew tap — review the tap/formula source before installing; 2) running summarization will send the provided content to whichever model provider or fallback service you configure (OpenAI/Anthropic/xAI/Google, Firecrawl, Apify), so avoid sending sensitive data and limit API key scope; 3) the skill references a per-user config at ~/.summarize/config.json — inspect any config you create and its permissions; 4) if you need stronger privacy, audit the summarize CLI source or prefer a vetted/local tool; and 5) consider using network monitoring or a disposable API key when testing.

Summarize

Fast CLI to summarize URLs, local files, and YouTube links.

Quick start

summarize "https://example.com" --model google/gemini-3-flash-preview
summarize "/path/to/file.pdf" --model google/gemini-3-flash-preview
summarize "https://youtu.be/dQw4w9WgXcQ" --youtube auto

Model + keys

Set the API key for your chosen provider:

• OpenAI: OPENAI_API_KEY
• Anthropic: ANTHROPIC_API_KEY
• xAI: XAI_API_KEY
• Google: GEMINI_API_KEY (aliases: GOOGLE_GENERATIVE_AI_API_KEY, GOOGLE_API_KEY)

Default model is google/gemini-3-flash-preview if none is set.

Useful flags

• --length short|medium|long|xl|xxl|<chars>
• --max-output-tokens <count>
• --extract-only (URLs only)
• --json (machine readable)
• --firecrawl auto|off|always (fallback extraction)
• --youtube auto (Apify fallback if APIFY_API_TOKEN set)

Config

Optional config file: ~/.summarize/config.json

{ "model": "openai/gpt-5.2" }

Optional services:

• FIRECRAWL_API_KEY for blocked sites
• APIFY_API_TOKEN for YouTube fallback