skill-0331-02

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:17 AM UTC
• Version: 1.0.6

Overview

This summarizer skill does what it claims, but it under-discloses external data sharing and installs an unpinned third-party CLI that will handle user files and API keys.

Review this before installing if you may summarize private documents, internal URLs, regulated data, or secrets. Use only approved provider keys, avoid exposing unrelated environment variables, and consider installing only if you trust the third-party Homebrew tap and upstream CLI update process.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Executable Installed from a Third-Party Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned third-party supply-chain dependency
Risk Level: Medium

Complete Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"🧾","requires":{"bins":["summarize"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/summarize","bins":["summarize"],"label":"Install summarize (brew)"}]}}

Technical Analysis

The skill declares summarize as a required executable and instructs the host to install it from the external Homebrew tap steipete/tap. The dependency is not constrained to a reviewed version, immutable commit, checksum, or cryptographic signature.

Consequently, the two audited project files do not establish the precise implementation that will be installed and executed. The effective behavior can change independently of this skill package if the tap, formula, source archive, or distribution infrastructure is modified. Because no executable source is bundled, the installed CLI's implementation and data-handling behavior could not be reviewed as part of this audit.

This is a supply-chain exposure rather than evidence that the current upstream package is malicious.

Attack Path

1. An attacker compromises the referenced Homebrew tap, its maintainer account, formula source, or an upstream artifact used by the formula.
2. The attacker publishes a modified formula or executable while retaining the expected summarize package and binary names.
3. A host follows the skill's installation metadata and installs the dependency without an immutable version or independently verified integrity constraint.
4. The agent invokes the substituted summarize executable on a URL or local file.
5. The attacker-controlled executable runs with the invoking user's privileges and can access data and credentials available to that process.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user who i ...[truncated 616 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed, immutable release or source commit rather than relying on a mutable formula reference.
2. Verify the downloaded artifact using an independently published cryptographic checksum or signature before installation.
3. Prefer an official, trusted distribution channel with signed releases and transparent provenance.
4. Record the reviewed dependency version, source repository, expected digest, and update procedure in the skill metadata or documentation.
5. Review the dependency's installation scripts and executable source before approving updates.
6. Run the CLI with least privilege and expose only the files and environment variables required for the current operation.
7. Avoid passing unrelated secrets into the CLI process; use narrowly scoped provider credentials where supported.
8. Document whether local content is transmitted to external AI, extraction, or YouTube-processing services so users can make an informed data-handling decision.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly encourages summarizing URLs, local files, PDFs, images, audio, and YouTube links using third-party model providers and optional fallback services, but it does not warn users that the submitted content may be transmitted off-host to external APIs. This creates a meaningful data exposure risk because users may pass sensitive local files or private URLs under the assumption the operation is purely local.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.