ClawHub
Back to skill

Security audit

ctx-shrink

Security checks for vulnerabilities and agentic risk

Overview

The flagged content appears to be disclosed documentation for a command-line helper, not evidence of hidden credential access or unauthorized persistence.

Before installing, read the README and only run the optional PATH/symlink command if you want the helper available globally. Treat any tool that scans project files carefully: keep real secrets out of test repositories and confirm it does not upload file contents unless you explicitly intend that.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Credential Access

High
Category
Privilege Escalation
Content
| File              | Size | Risk        |
|-------------------|------|-------------|
| .env.production   | 2.1 KB| 🔴 CRITICAL |
| config/secrets.yml| 145 B | 🔴 CRITICAL |

### 🔧 Quick Fix
Add these to your `.gitignore`:
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
| File              | Size | Risk        |
|-------------------|------|-------------|
| .env.production   | 2.1 KB| 🔴 CRITICAL |
| config/secrets.yml| 145 B | 🔴 CRITICAL |

### 🔧 Quick Fix
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium
Category
Rogue Agent
Content
### Option 2: Add to your PATH (user directory)

```bash
mkdir -p ~/.local/bin
ln -sf "$(pwd)/ctx-shrink" ~/.local/bin/ctx-shrink
# Ensure ~/.local/bin is on PATH (e.g. in ~/.profile)
```
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.