ClawHub
Back to skill

Security audit

session-compactor

Security checks for vulnerabilities and agentic risk

Overview

The skill’s main session-compaction code is coherent, but it also ships an executable deployment script that can push the local directory to a hardcoded GitHub repository without confirmation.

Install only if you need the session compaction behavior and are comfortable reviewing the package first. Do not run deploy.sh unless you intentionally want to publish the current directory to the hardcoded GitHub repository, and consider removing or ignoring that script before using the skill in sensitive projects.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This script performs Git repository initialization, commit creation, remote configuration, and a push to GitHub, which is unrelated to the declared session-compaction functionality. In the context of an agent skill, bundling publishing behavior can cause unintended exfiltration of local project contents to a third-party service if a user runs it without fully understanding its effect.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The script has remote publishing capability via `git push -u origin main` after forcibly setting the remote URL. For a session-compaction skill, this capability is unjustified and dangerous because it can publish local source, configuration, or embedded secrets to GitHub, especially when executed as a convenience script by a trusting user.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The header presents the file as part of 'Session Compactor' while the body is a GitHub deployment script, creating a misleading trust signal. Mislabeling reduces user scrutiny and increases the chance they execute a script whose real effect is repository publication rather than local session-compaction support.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script modifies the repository state and performs a remote push without an explicit confirmation step, dry run, or warning about the consequences of publishing local content. This increases the risk of accidental disclosure and irreversible changes when a user runs the script expecting harmless setup behavior.

Static analysis

No suspicious patterns detected.