Context Optimizer Pro

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:55 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-built for continuing long sessions, but it can automatically inspect and carry private conversation history into new sessions without enough redaction or user control.

Install only if you are comfortable with the skill reading conversation history and carrying selected details into new sessions. Do not enable cron or automatic spawning until you have a review step, redaction for secrets, and clear limits on what history can be copied.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/session_extractor.py:217

Finding

Untrusted conversation content is injected into continuation prompts

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/session_extractor.py:273

Finding

Sensitive session history can leak through command-line arguments and generated output

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/context_optimizer.py (reported line 143)May include surrounding context.

python

prompt += "Continue from where the previous session left off. "
    prompt += "Focus on completing unfinished tasks and preserving the work done."
    
    return prompt


def split_session(threshold: float = DEFAULT_THRESHOLD):

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 75% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · scripts/session_extractor.py (reported line 26)May include surrounding context.

python

def parse_session_status(status_json: Dict) -> Dict:
    """Parse session status to get context usage."""
    # Extract context from status output
    # Format: "Context: 25k/200k (13%)"
    context_str = status_json.get("context", "0")

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 89% confidence

Finding

Returning the generated continuation prompt is dangerous because the prompt includes directly extracted session content, including recent messages and preserved context. In an agent-skill setting, that output is likely to be consumed by another model or session, making prompt contents a high-risk vehicle for propagating confidential data and hidden instructions across trust boundaries.

Content

Scanner excerpt · scripts/session_extractor.py (reported line 250)May include surrounding context.

python

prompt += "3. Preserving important context above\n"
    prompt += "4. Building on recent progress\n"
    
    return prompt


def analyze_session(status_json: Dict, messages: List[Dict]) -> Dict:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly describes automatic analysis of conversation history and extraction of key context, including user preferences, then carrying that data into a new session, but it does not warn users about this data handling behavior. This creates a privacy and consent risk because sensitive information from prior conversation context may be summarized, persisted, or propagated across sessions without clear user awareness.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The phrase "When triggered" does not clearly define the exact activation condition for the monitoring action, beyond nearby contextual hints. In a markdown skill reference, this ambiguity can cause inconsistent or unintended invocation because it does not specify what event counts as a trigger or what does not.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cron-usage.md (reported line 24)May include surrounding context.

Option 2: Cron Job

Create a cron job to check context every 10 minutes:

bash

# Context monitor cron job

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The function explicitly extracts 'important context' from recent messages and returns matched content verbatim, while the comment claims API keys or credentials are masked. There is no masking or redaction logic, so secrets, config values, URLs, or error text embedded in conversation history can be preserved and later re-emitted, causing sensitive data disclosure.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The extractor is designed to capture configuration text, URLs, and error messages from recent messages for later preservation. Those categories frequently contain secrets, internal endpoints, stack traces, and environment details, so storing and reusing them increases the risk of sensitive conversational data leakage.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The continuation prompt intentionally carries forward user-provided content such as unfinished tasks, decisions, file paths, preferences, and recent message excerpts. This creates a natural-language exfiltration channel across sessions or model boundaries, allowing sensitive information from one context to be reproduced in another without strict need-to-know controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The CLI emits extracted session data and, in prompt mode, prints a continuation prompt containing recent conversation content, file paths, and preferences without any warning, consent gate, or sensitivity check. If used in shared terminals, logs, pipelines, or CI, this can expose private conversation data to unintended viewers or downstream systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.