0514-tosr2-skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:46 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward wrapper for a summarization CLI, but users should understand that local files and URLs may be processed by external services and that the CLI is installed from an unpinned third-party Homebrew tap.

Install only if you are comfortable trusting the third-party summarize CLI and its Homebrew tap. Do not summarize secrets, confidential documents, private URLs, or regulated data unless you have approval to send that content to the selected model provider and any enabled fallback services such as Firecrawl or Apify.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6

Finding

Unpinned Third-Party Homebrew Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 6
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"🧾","requires":{"bins":["summarize"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/summarize","bins":["summarize"],"label":"Install summarize (brew)"}]}}

Technical Analysis

The installation metadata directs the environment to obtain the summarize executable from the third-party Homebrew tap steipete/tap. It does not pin the dependency to a reviewed version or commit and provides no artifact checksum or other integrity-verification mechanism.

Consequently, the executable installed in the future may differ from the component represented by the audited skill metadata. A compromise of the tap, its maintainer account, the formula's upstream distribution location, or its release infrastructure could cause installation of an attacker-controlled formula or binary.

This finding concerns the dependency acquisition mechanism. The audited files contain no evidence that the current tap or package is malicious.

Attack Path

1. An attacker compromises the third-party tap, a maintainer account, or the referenced package's upstream release infrastructure.
2. The attacker modifies the Homebrew formula or replaces its downloadable artifact with a malicious version.
3. A user or agent follows the skill's installation metadata and installs steipete/tap/summarize.
4. Homebrew retrieves and installs the modified dependency because the skill does not constrain it to a separately verified commit, version, and checksum.
5. The installed summarize executable runs under the user's account when the skill processes a URL or local file.
6. The malicious executable can act with the invoking user's effective permissions.

Impact Assessment

Successful exploitation could permit arbitrary code execution with t ...[truncated 488 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specific audited release and, where supported, an immutable source commit.
2. Verify downloaded artifacts using a cryptographic checksum obtained through a trusted channel.
3. Prefer a first-party or otherwise vetted package source and document the canonical source repository.
4. Review the Homebrew formula and its complete transitive dependency chain before approving updates.
5. Use automated dependency monitoring, but require security review before changing the pinned version or checksum.
6. Run the tool with least privilege and provide only the API keys and filesystem access required for the current operation.
7. Avoid exposing unrelated secrets through the process environment when invoking the executable.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly encourages summarizing URLs, local files, PDFs, images, audio, and YouTube content using third-party model providers and optional fallback services, but it does not warn users that submitted content may be transmitted off-device for processing. This can lead to unintended disclosure of sensitive local files, private URLs, or regulated data when users assume the tool operates locally or do not realize that optional services like Firecrawl or Apify may also receive content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.