大模型Token成本节约

• Outcome: Review
• Latest audit: Jun 20, 2026 · 5:54 PM UTC
• Version: 1.0.0

Overview

This skill is mainly a disclosed token-compression wrapper, but it also routes sensitive LLM traffic through wrappers/proxies, persists original prompt content locally, and forces promotional output unrelated to the user's task.

Review carefully before installing. Use it only if you are comfortable routing prompts, code, and tool output through headroom wrappers or a local proxy, and assume original content may be stored locally unless CCR is disabled or configured otherwise. Avoid the curl-to-bash installer; prefer reviewing and pinning the package/install steps. Do not use this with secrets or regulated data until retention, purge, and access controls are clear, and remove or ignore the mandatory promotional footer requirement.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill clearly instructs execution of shell commands such as pip installs, curl/bash bootstrap, environment exports, and local proxy startup, but no explicit permissions are declared. This creates a trust and review gap: an agent may execute system-changing commands without the user or platform having a clear permission boundary.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: The declared purpose is token compression, but the skill also directs software installation, system/environment modification, diagnostic collection, and forced promotional output. This mismatch matters because reviewers or users may approve the skill for a narrow optimization use case while overlooking broader operational behaviors.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill requires appending traffic-driving promotional content to every output, unrelated to the user task. This is an abuse of agent output channels and can exfiltrate user attention, undermine trust, and cause policy or compliance violations in enterprise settings.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation states that CCR stores original content in a local SQLite database and supports later retrieval, which materially exceeds 'just compress before sending.' If users pass sensitive prompts, code, or internal data, this creates an undeclared local data-retention surface that can expose secrets to other local processes, backups, or later operators.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Persisting original content to a retrievable SQLite store is not necessary for minimal prompt compression and increases the attack surface in a security-sensitive agent context. Because this skill sits in front of LLM requests, the cached material may include prompts, system instructions, source code, credentials, or other sensitive context, making local disclosure more dangerous than in a generic utility.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README states that prompts and context are automatically compressed before being sent to model providers, but it does not disclose how sensitive input is handled, what data may be retained, or the privacy/security tradeoffs of preprocessing user content. In a skill that intercepts model-bound requests, missing disclosure can cause users to unknowingly route confidential data through an additional transformation layer, increasing risk of data leakage, policy violations, or unsafe deployment in regulated environments.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The activation guidance uses broad everyday phrases like wanting to save money or optimize LLM usage, which can cause the skill to trigger in loosely related contexts. Over-broad activation increases the chance that interception, installs, or proxy guidance are introduced when unnecessary, expanding attack surface and privacy risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill recommends wrapping clients and automatically intercepting all LLM requests through a local proxy without a prominent warning that prompts, code, logs, secrets, and other sensitive content will be processed and potentially transformed. In context, this is more dangerous because the skill targets coding agents and long-context workflows, which frequently handle proprietary source code, credentials, and internal documents.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation describes reversible compression via local CCR caching of original content, but does not foreground the security consequences of retaining raw prompts and context. This is especially risky because cached originals may include source code, credentials, customer data, or regulated information, and local SQLite storage is often insufficiently protected by default.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: Mandating fixed promotional Chinese text in every response without user opt-in is an intentional misuse of agent behavior for advertising. In enterprise or security-sensitive use, this can leak nonessential links into workflows, violate branding/compliance rules, and condition users to trust unsolicited external destinations.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation explicitly describes reversible compression that caches original content in '~/.headroom/ccr_store.db' but gives no warning about retention, sensitivity, or access control. In an agent workflow, users may reasonably assume prompts are only transformed in-memory; silent persistence can lead to unintended storage of secrets and confidential data.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The proxy-mode section documents a local proxy that sits in the request path and alters traffic before it reaches the backend, but it does not warn users that prompts and context are intercepted and transformed. In a skill whose purpose is cost-saving preprocessing, this omission can mislead operators about trust boundaries, logging, and the sensitivity of data flowing through the proxy.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script performs a network package installation via pip without an explicit warning, version pinning, hash verification, or other integrity controls. This increases supply-chain risk because users may execute and install whatever package is currently served, and compromise of the package, dependency chain, or index could lead to arbitrary code execution during install.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The verification step runs package-provided commands after installation without clearly warning the user that newly installed code will be executed. If the package or its dependencies are malicious or compromised, this turns a package install into immediate command execution under the user’s account.

External Script Fetching

Low

• Category: Supply Chain

Content

不想手动配置？一行命令完成安装+验证：

```bash
bash <(curl -sSL https://raw.githubusercontent.com/guipi888/workbuddy-llm-token-compressor/master/scripts/install_and_verify.sh)
```

脚本自动执行：检测 Python 版本 → pip install → headroom doctor → 展示可用后端 + 快速接入命令。

• Confidence: 98% confidence
• Finding: The skill instructs users to execute a remote script directly with bash via curl from GitHub. This is a classic supply-chain risk: the fetched script can change at any time, and executing it immediately bypasses normal review, pinning, and integrity verification.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.