Trust Assessment
summarize received a trust score of 56/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 4 findings: 0 critical, 2 high, 2 medium, and 0 low severity. Key findings include Potential Data Exfiltration via Local File Access, Potential Command Injection via Unsanitized User Input, Broad Tool Permissions (Filesystem and Network Access).
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Static Code Analysis layer scored lowest at 56/100, indicating areas for improvement.
Last analyzed on February 18, 2026 (commit b62bd290). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Data Exfiltration via Local File Access The skill instructs the agent on how to use the `summarize` tool, which has the capability to read and process local files (e.g., `summarize "/path/to/file.pdf"`). If the agent is prompted to summarize a user-specified local file path, the content of that file could be exfiltrated by being included in the summary returned to the user or sent to a third-party LLM API. Implement strict validation and sanitization of file paths provided by users. Restrict the agent's access to specific, non-sensitive directories or disallow local file summarization entirely if not strictly necessary. Ensure that any data sent to external APIs is reviewed for sensitivity. | Static | SKILL.md:20 | |
| HIGH | Potential Command Injection via Unsanitized User Input The skill instructs the agent to execute the `summarize` CLI tool via shell commands. If user-provided input (e.g., URLs, file paths) is directly interpolated into these shell commands without proper sanitization and escaping, a malicious user could inject arbitrary shell commands. For example, `summarize "https://example.com"; rm -rf /` could lead to arbitrary code execution on the host system. When constructing shell commands with user-provided input, always use a robust method for escaping or sanitizing the input. Prefer using libraries or functions designed for safe command execution (e.g., `subprocess.run` with `shell=False` and passing arguments as a list) rather than direct string concatenation for shell commands. | Static | SKILL.md:19 | |
| MEDIUM | Broad Tool Permissions (Filesystem and Network Access) The `summarize` tool, as described by the skill, possesses broad permissions including the ability to read arbitrary local files and make network requests to any URL. While these are core functionalities, granting an AI agent access to a tool with such capabilities without strict sandboxing or input validation significantly increases the attack surface for data exfiltration, command injection, or other malicious activities. Implement strict sandboxing for the `summarize` tool's execution environment. Restrict network access to only necessary domains. Limit filesystem access to specific, non-sensitive directories. Carefully review and validate all inputs to the tool. | Static | SKILL.md:19 | |
| MEDIUM | Unpinned External Dependency The skill's manifest specifies the installation of the `summarize` tool via `brew install steipete/tap/summarize`. However, it does not pin a specific version of the tool. This means that future updates to the `summarize` tool could introduce breaking changes, vulnerabilities, or even malicious code without explicit review by the skill maintainer, posing a supply chain risk. Pin the version of the `summarize` tool in the installation instructions (e.g., `brew install steipete/tap/summarize@1.2.3`). Regularly review and update the pinned version after verifying its integrity and security. | Static | SKILL.md |
Scan History
Embed Code
[](https://skillshield.io/report/afdba61426c764fe)
Powered by SkillShield