context-optimization

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:00 AM UTC
• Version: 1.9.19

Overview

This context-management skill is mostly coherent, but it should be reviewed because it encourages broad agent-log inspection and persistent memory/files without clear privacy boundaries.

Install only if you are comfortable with a context-management skill that may guide agents to inspect Claude agent logs and write persistent coordination or memory files. Keep use scoped to the active project, avoid storing secrets or personal data in memory/checkpoint files, and review any suggested ~/.claude log access or shell configuration changes before allowing them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (12)

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

are deduplicated: local config wins. This protects MECW
compliance for sessions using many MCP servers.

### Idle-Return Prompt (2.1.84+)

When returning after 75+ minutes of inactivity, Claude
Code nudges the user to `/clear`. Sessions idle that

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

```bash
# Look for compaction boundaries in recent logs
grep -r "compact_boundary" ~/.claude/projects/*/agent_*.log | tail -5
```

## Critical: Subagent Overhead Reality

• Confidence: 85% confidence
• Finding: The module instructs agents to read from `~/.claude/projects/*/agent_*.log`, which reaches into agent configuration/runtime data outside the immediate task workspace. Even though the example targets compaction diagnostics, this directory can contain sensitive prompts, tool outputs, file paths, or operational metadata, and normalizing access to it increases the chance of unintended data exposure across sessions or projects.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest trigger 'context exceeds 30% or before long multi-step tasks' is broad and lacks precise boundaries, especially for 'long multi-step tasks,' which could overlap with many ordinary workflows. It is also inconsistent with the later guidance that says to use the skill when context approaches 50%, making activation conditions unclear.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The module expands from context-window optimization into inter-plugin coordination and resource allocation, which is a scope mismatch from the declared skill purpose. Hidden cross-plugin behavior increases privilege and observability over other components, creating a pathway for unintended data exposure, control over plugin execution flow, or abuse of shared resources if adopted as written.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The code explicitly waits on other plugins' readiness and coordinates their behavior despite the skill being presented as a context-optimization utility. This creates an undeclared orchestration capability that can be used to inspect or influence external plugin state, which is dangerous because consumers may grant trust or deployment approval based on a narrower advertised function.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The collective monitoring and optimization logic goes beyond observing local context pressure and introduces centralized oversight of multiple plugins' resource usage. In a skill whose stated purpose is context optimization, this unjustified expansion is risky because it can enable broad telemetry collection and coordinated actions across components without clear consent, increasing blast radius if misused or compromised.

Unbounded Output

Medium

• Category: Output Handling

Content

pressure = calculate_context_pressure(
    current_tokens=80000,
    max_tokens=1000000
)
print(pressure)  # "MODERATE"
```

• Confidence: 80% confidence
• Finding: Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Unbounded Output

Medium

• Category: Output Handling

Content

pressure = calculate_context_pressure(
    current_tokens=80000,
    max_tokens=1000000
)
print(pressure)  # "MODERATE"
```

• Confidence: 80% confidence
• Finding: Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document explicitly defines persistent multi-tier memory, including archival of historical records, but provides no guidance on consent, retention limits, sensitive-data handling, or user notice. In an agent context, this can lead to unintended storage of prompts, secrets, personal data, or confidential decisions across sessions, increasing privacy, compliance, and data exposure risk.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Pattern: Externalize critical state before compaction risk
def preserve_subagent_state(progress):
    """
    Write state to files so it survives compaction.
    """
    # Write to TodoWrite for task state
    todo_state = {

• Confidence: 87% confidence
• Finding: The guidance promotes durable session persistence as a general best practice for subagents, which can cause agents to retain more context than necessary and increase the attack surface if files are later read by other tools, users, or processes. In this coordination context, the danger is elevated because preserved state may aggregate outputs from multiple subagents and therefore concentrate sensitive information.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Pattern: Externalize critical state before compaction risk
def preserve_subagent_state(progress):
    """
    Write state to files so it survives compaction.
    """
    # Write to TodoWrite for task state
    todo_state = {

• Confidence: 87% confidence
• Finding: The guidance promotes durable session persistence as a general best practice for subagents, which can cause agents to retain more context than necessary and increase the attack surface if files are later read by other tools, users, or processes. In this coordination context, the danger is elevated because preserved state may aggregate outputs from multiple subagents and therefore concentrate sensitive information.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The skill context describes context optimization via MECW and this module documents subagent coordination patterns, but it also includes a bash command to recursively grep local agent logs under `~/.claude/projects`. Inspecting host log files is not an obvious requirement of workflow decomposition or delegation itself, and introduces filesystem access beyond the core coordination guidance.

Static analysis

No suspicious patterns detected.