test-0313-skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:48 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward wrapper for an external summarization CLI, but users should understand it may send chosen files or links to third-party services and installs a third-party Homebrew package.

Install only if you trust the summarize CLI and its Homebrew tap. Do not summarize sensitive, regulated, or private documents unless you are comfortable with the selected model provider and optional fallback services receiving that content and the required API credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Dependency Installed from a Third-Party Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5
Vulnerability Type: Unpinned third-party dependency and mutable supply-chain source
Risk Level: Medium

Vulnerable Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"🧾","requires":{"bins":["summarize"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/summarize","bins":["summarize"],"label":"Install summarize (brew)"}]}}

Technical Analysis

The installation metadata directs Homebrew to install the summarize executable from the third-party steipete/tap tap. It does not pin an immutable package version, source commit, artifact digest, or verified signature.

The executable and Homebrew formula are not included in the audited project, so their implementation and future changes cannot be verified from this package. Consequently, the effective installed code may change after this Skill has been reviewed. This creates a supply-chain trust boundary in which compromise of the tap, its maintainers, release infrastructure, or referenced artifacts could cause users to install altered code.

This finding does not establish that the current external package is malicious. The risk arises from relying on a mutable, externally controlled installation source without integrity pinning.

Attack Path

1. An attacker compromises the third-party Homebrew tap, a maintainer account, its release infrastructure, or an artifact referenced by its formula.
2. The attacker modifies the formula or distributed executable while retaining the expected package and binary names.
3. A user or agent installs the dependency through the Skill metadata using steipete/tap/summarize.
4. Homebrew retrieves and installs the modified dependency because the Skill does not constrain installation to an independently verified immutable version.
5. The installed summarize executable runs under the installing user's account when the Skill processes a URL or local file.

...[truncated 1031 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specific, reviewed release rather than relying on the latest mutable tap state.
2. Verify downloaded artifacts using a cryptographic checksum obtained through a separately trusted channel.
3. Prefer signed releases and validate the publisher's signature before installation.
4. Record the exact audited formula revision, source commit, package version, and artifact digest in the Skill metadata or installation documentation.
5. Prefer an official or project-controlled package source with documented release and provenance controls.
6. Add automated dependency monitoring so changes to the formula, source URL, checksum, signing identity, or transitive dependencies trigger a new security review.
7. Run the CLI with least privilege and isolate it from unrelated files and environment variables. Provide only the credentials and input files required for the current operation.
8. Where practical, use short-lived, narrowly scoped API credentials and revoke or rotate them if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly supports summarizing URLs, local files, and YouTube content via external model providers and optional fallback services, but it does not warn users that submitted content may leave the local environment. This can lead to unintended disclosure of sensitive local documents, private URLs, or media to third-party APIs such as OpenAI, Anthropic, Google, Firecrawl, or Apify.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.