Security audit
Security checks for vulnerabilities and agentic risk
This context-management skill is mostly coherent, but it should be reviewed because it encourages broad agent-log inspection and persistent memory/files without clear privacy boundaries.
Install only if you are comfortable with a context-management skill that may guide agents to inspect Claude agent logs and write persistent coordination or memory files. Keep use scoped to the active project, avoid storing secrets or personal data in memory/checkpoint files, and review any suggested ~/.claude log access or shell configuration changes before allowing them.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
are deduplicated: local config wins. This protects MECW
compliance for sessions using many MCP servers.
### Idle-Return Prompt (2.1.84+)
When returning after 75+ minutes of inactivity, Claude
Code nudges the user to `/clear`. Sessions idle that
The module instructs agents to read from ~/.claude/projects/*/agent_*.log, which reaches into agent configuration/runtime data outside the immediate task workspace. Even though the example targets compaction diagnostics, this directory can contain sensitive prompts, tool outputs, file paths, or operational metadata, and normalizing access to it increases the chance of unintended data exposure across sessions or projects.
# Look for compaction boundaries in recent logs
grep -r "compact_boundary" ~/.claude/projects/*/agent_*.log | tail -5
The manifest trigger 'context exceeds 30% or before long multi-step tasks' is broad and lacks precise boundaries, especially for 'long multi-step tasks,' which could overlap with many ordinary workflows. It is also inconsistent with the later guidance that says to use the skill when context approaches 50%, making activation conditions unclear.
The module expands from context-window optimization into inter-plugin coordination and resource allocation, which is a scope mismatch from the declared skill purpose. Hidden cross-plugin behavior increases privilege and observability over other components, creating a pathway for unintended data exposure, control over plugin execution flow, or abuse of shared resources if adopted as written.
The code explicitly waits on other plugins' readiness and coordinates their behavior despite the skill being presented as a context-optimization utility. This creates an undeclared orchestration capability that can be used to inspect or influence external plugin state, which is dangerous because consumers may grant trust or deployment approval based on a narrower advertised function.
The collective monitoring and optimization logic goes beyond observing local context pressure and introduces centralized oversight of multiple plugins' resource usage. In a skill whose stated purpose is context optimization, this unjustified expansion is risky because it can enable broad telemetry collection and coordinated actions across components without clear consent, increasing blast radius if misused or compromised.
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
pressure = calculate_context_pressure( current_tokens=80000, max_tokens=1000000 ) print(pressure) # "MODERATE"
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
pressure = calculate_context_pressure( current_tokens=80000, max_tokens=1000000 ) print(pressure) # "MODERATE"
The document explicitly defines persistent multi-tier memory, including archival of historical records, but provides no guidance on consent, retention limits, sensitive-data handling, or user notice. In an agent context, this can lead to unintended storage of prompts, secrets, personal data, or confidential decisions across sessions, increasing privacy, compliance, and data exposure risk.
The guidance promotes durable session persistence as a general best practice for subagents, which can cause agents to retain more context than necessary and increase the attack surface if files are later read by other tools, users, or processes. In this coordination context, the danger is elevated because preserved state may aggregate outputs from multiple subagents and therefore concentrate sensitive information.
# Pattern: Externalize critical state before compaction risk
def preserve_subagent_state(progress):
"""
Write state to files so it survives compaction.
"""
# Write to TodoWrite for task state
todo_state = {
The guidance promotes durable session persistence as a general best practice for subagents, which can cause agents to retain more context than necessary and increase the attack surface if files are later read by other tools, users, or processes. In this coordination context, the danger is elevated because preserved state may aggregate outputs from multiple subagents and therefore concentrate sensitive information.
# Pattern: Externalize critical state before compaction risk
def preserve_subagent_state(progress):
"""
Write state to files so it survives compaction.
"""
# Write to TodoWrite for task state
todo_state = {
The skill context describes context optimization via MECW and this module documents subagent coordination patterns, but it also includes a bash command to recursively grep local agent logs under ~/.claude/projects. Inspecting host log files is not an obvious requirement of workflow decomposition or delegation itself, and introduces filesystem access beyond the core coordination guidance.