ClawHub
Back to skill

Security audit

Context Compression Claude Code Custom

Security checks for vulnerabilities and agentic risk

Overview

This compression skill is review-worthy because it can save conversation details, including credential or configuration information, into long-term memory without clear consent or redaction safeguards.

Install only if you are comfortable with a compression skill maintaining long-term memory. Before enabling hooks, remove or rewrite the credential/config preservation language, require explicit review before any memory write, and ensure secrets, tokens, passwords, private keys, session cookies, and sensitive account details are never stored in the memory file.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:31
Finding

Plaintext Persistence of Credentials and Sensitive Account Information

Content
View full analysis
- ``` `setup-hook.md:31-32`: ```json "type": "prompt", "prompt": "Compression complete. Please check if there's anything that needs to be written to long-term memory (user preferences, incomplete tasks, important decisions). If so, update the user's memory file in the format of ~/.claude/skills/context-compression/memory-template.md.", ``` ### Technical Analysis The skill explicitly classifies credentials, account information, paths, and configuration as content that must be preserved. It subsequently instructs the agent to write high-persistence information into a Markdown memory file. The supplied template provides a dedicated section for account, path, and configuration information, while the optional PostCompact hook prompts the agent to perform this persistent update after compression. No controls are specified for: - Detecting or redacting passwords, API keys, private keys, access tokens, session cookies, recovery codes, or similar secr ...[truncated 2402 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly instructs preserving 'key credentials or config' and later writing high-persistence-value information to a memory file, which creates a direct pathway for secrets to be stored in persistent plaintext-like memory artifacts. In this context-compression workflow, that is especially dangerous because activation can be broad or automatic, so sensitive tokens, account details, paths, or configuration secrets may be retained without strong user awareness or need.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · setup-hook.md (reported line 11)May include surrounding context.

Claude Code Configuration

Edit ~/.claude/settings.json and add the following configuration:

json
{

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · setup-hook.md (reported line 22)May include surrounding context.

md
"hooks": [
          {
            "type": "command",
            "command": "cat ~/.claude/skills/context-compression/SKILL.md | python3 -c \"import sys,json; content=sys.stdin.read(); print(json.dumps({'hookSpecificOutput': {'hookEventName': 'PreCompact', 'additionalContext': content}}))\"",
            "timeout": 10,
            "statusMessage": "Loading compression strategy..."
          }

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is configured to trigger on broad phrases like 'summarize' or whenever context 'is getting long,' which can cause the agent to invoke compression during ordinary interactions without clear user intent. In this skill, that behavior is more dangerous because activation leads to summarization plus persistence of conversation details into a memory file, creating privacy and integrity risks from accidental invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The top-level skill description says the skill 'writes a structured memory file' but does not clearly warn users that retained conversation details may be persisted beyond the immediate context window. In a compression skill, that omission is significant because users may interpret summarization as transient context management rather than durable storage of potentially sensitive data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manual triggers 'compress my context' and 'context is getting long, clean it up' are loosely defined and can overlap with common conversational requests for summarization or cleanup. Because this skill also updates memory state, ambiguous triggers increase the chance of unintended retention, deletion, or transformation of user context beyond what the user expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The template explicitly encourages retaining long-term user information such as preferences, active tasks, decisions, accounts, paths, and configuration details across sessions, but it provides no user-facing warning or minimization guidance for sensitive data. In a context-compression skill, this increases the chance that personal, credential-adjacent, or operationally sensitive information will be persistently stored without clear notice or consent boundaries.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · setup-hook.md (reported line 22)May include surrounding context.

md
"hooks": [
          {
            "type": "command",
            "command": "cat ~/.claude/skills/context-compression/SKILL.md | python3 -c \"import sys,json; content=sys.stdin.read(); print(json.dumps({'hookSpecificOutput': {'hookEventName': 'PreCompact', 'additionalContext': content}}))\"",
            "timeout": 10,
            "statusMessage": "Loading compression strategy..."
          }

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The PostCompact prompt instructs the agent to update a persistent user memory file with preferences, tasks, and decisions, but does not require explicit user notice or consent before modifying long-term stored data. This creates a privacy and integrity risk because sensitive or incorrect information may be persisted automatically after routine compression events.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manual invocation examples use very broad natural-language phrases like 'clean up conversation history' and 'organize it', which can cause accidental triggering if users use similar wording in unrelated contexts. In a context-compression skill that can alter conversation state or drive subsequent memory-writing behavior, ambiguous activation increases the risk of unintended summarization or loss of detail.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.