compression-strategy

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:40 AM UTC
• Version: 1.9.19

Overview

This skill is a coherent context-management aid, with some practical safety cautions around clearing sessions, pasted logs, and optional third-party tooling.

Before installing or using this skill, treat its recommendations as manual actions: confirm any session state is saved before /clear, avoid archiving secrets into .claude files, redact sensitive log data before pasting, and prefer a pinned or preinstalled tiktoken environment for token counting.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: modules/log-debugging-hygiene.md:140

Finding

Unpinned Runtime Retrieval and Execution of a Third-Party Python Package

Content

View full analysis

Vulnerability Details

File Location: modules/log-debugging-hygiene.md, lines 140-146
Vulnerability Type: Unpinned third-party dependency executed through uv
Risk Level: Medium

Vulnerable Code

bash

uv run --quiet --with tiktoken python3 -c "
import tiktoken, sys
enc = tiktoken.get_encoding('cl100k_base')
print(len(enc.encode(open(sys.argv[1]).read())))
" file.log

Technical Analysis

The documented command instructs users to resolve and execute tiktoken dynamically through uv --with tiktoken. It does not specify an exact package version, lockfile, artifact hash, trusted package index, or other integrity constraint.

Consequently, the dependency selected when the command is run may differ from the dependency reviewed when the skill was published. The command then imports the resolved package in a Python process, causing its module initialization code to execute with the privileges of the invoking user.

This is a supply-chain weakness rather than evidence that the current tiktoken package is malicious. Exploitation requires compromise of the selected package release, its transitive dependency chain, the configured package registry, or the local package-resolution environment.

Attack Path

1. An attacker compromises a future tiktoken distribution, a relevant transitive dependency, or a package source trusted by the victim's uv configuration.
2. A user follows the skill's token-measurement instructions and runs the documented uv run --with tiktoken command.
3. Because no exact version or artifact hash is specified, uv resolves the attacker-controlled package or dependency.
4. The Python command imports tiktoken.
5. Malicious initialization code executes under the user's account and can access resources available to that account.

Impact Assessment

Successful exploitation would provide code execution with the privileges of the user running the command. Depending on that user's environment, the malicious pa ...[truncated 464 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin tiktoken to an audited exact version rather than resolving an unconstrained release.
2. Record the dependency and its transitive dependencies in a committed lockfile.
3. Enforce artifact hashes during installation or resolution so substituted distributions are rejected.
4. Configure uv to use an explicitly trusted package index and prevent dependency-confusion fallback to unintended indexes.
5. Prefer a pre-provisioned, reviewed environment instead of downloading dependencies when the documentation command is invoked.
6. Document that the command may retrieve third-party software and advise users to inspect the resolved dependency set before execution.
7. Where practical, replace the runtime dependency with a bundled, reviewed token-counting utility or clearly identify an approved installed version.

For example, the documentation should reference a project-managed locked environment and invoke the tool without unconstrained resolution:

bash

uv run --locked python3 -c "
import tiktoken, sys
enc = tiktoken.get_encoding('cl100k_base')
print(len(enc.encode(open(sys.argv[1]).read())))
" file.log

The corresponding project lockfile should pin the audited package version and integrity information.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill recommends /clear as part of its normal workflow and mentions saving critical state, but it does not explicitly warn the user that conversational context, ad hoc reasoning, and any unsaved session details may be lost or only partially preserved. In an agent setting, this can lead to accidental destruction of important state or incorrect continuation if the preserved summary is incomplete.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module explicitly encourages pasting logs into an AI session but does not warn users to scrub secrets, credentials, personal data, or internal identifiers first. Logs commonly contain API keys, tokens, stack traces, hostnames, and customer data, so this omission can lead to unintended disclosure to the model or anyone with access to the session transcript.

Content

No source excerpt is available for this finding.