🦐 Shrink — Three-Tier Multimodal Context Optimizer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:41 AM UTC
• Version: 1.2.0

Overview

The skill does what it claims, but it sends session images plus nearby conversation to Anthropic and permanently rewrites agent history with unvalidated model-generated text.

Review this skill before installing if your OpenClaw sessions may contain secrets, customer data, regulated records, or untrusted screenshots. Prefer explicit ANTHROPIC_API_KEY selection, use dry-run, limit scope with a single agent or session, avoid --all-sessions unless needed, and treat --redact as output redaction rather than proof that sensitive source data was never sent to Anthropic.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: scripts/shrink.py:622

Finding

Unvalidated Vision-Model Output Is Persisted in Agent Session History

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/shrink.py:367

Finding

Redaction Is Applied Only After Sensitive Data Has Been Sent to Anthropic

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

The skill context makes this more dangerous because it operates on session history, where screenshots often contain account data, internal dashboards, error traces, and secrets, and the surrounding messages may explain or reproduce those secrets in text. Sending contextual excerpts to improve descriptions is functionally a context-leak pathway, not just image summarization.

Content

Scanner excerpt · scripts/shrink.py (reported line 157)May include surrounding context.

python

def extract_surrounding_context(lines, line_idx, content, content_idx, context_depth=5):
    """Extract conversation context around an image for context-aware description."""
    context_parts = []

    # 1. Get text from the SAME message

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The prompt explicitly instructs the model to extract and preserve all readable text, numbers, names, IDs, URLs, and other data visible in the image, which maximizes retention of sensitive content by default. In a session-shrinking tool, that means the compressed output may still preserve secrets and PII while also transmitting them to a third party during processing.

Content

No source excerpt is available for this finding.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

This call site activates the context-leak behavior during normal processing of each image, making the issue operational rather than theoretical. Because the tool is designed to batch-process session files, a single run can repeatedly exfiltrate neighboring conversation content for many images at scale.

Content

Scanner excerpt · scripts/shrink.py (reported line 584)May include surrounding context.

python

src = dedup_cache.get(f"{fp}_src", "earlier")
                print(f"   ♻️ Duplicate detected — reusing description from {src}")
        else:
            # Extract conversation context
            context = extract_surrounding_context(lines, line_idx, content, content_idx, context_depth)
            if log and verbose and context:
                context_preview = context.split("\n")[0][:100]

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are broad enough to match ordinary discussion about shrinking context or reducing image bloat, which can cause the skill to activate in situations where the user did not intend a destructive session rewrite. Because the skill reads session history, sends images and conversation context to an external API, writes modified JSONL files, and may prompt for a gateway restart, accidental invocation has meaningful privacy and integrity consequences.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/shrink.py (reported line 26)May include surrounding context.

python

VISION_MODEL_OAUTH = "claude-haiku-4-5"  # OAuth tokens (Max/Max Pro) — only Haiku works direct
VISION_MODEL_APIKEY = "claude-sonnet-4-6"  # API keys — full model access
MAX_DESCRIPTION_TOKENS = {"standard": 500, "full": 800}
ANTHROPIC_API_URL = "https://api.anthropic.com/v1/messages"
ANTHROPIC_VERSION = "2023-06-01"

MODEL_PRICING = {

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The context extraction routine collects prior user messages, same-message text, and the next assistant response, then packages that material into the prompt sent with the image. This broadens data exposure well beyond the image itself and can leak unrelated confidential session content, credentials, or personal information to the external model provider.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script sends base64 image contents plus extracted surrounding conversation context to Anthropic's external API, but it does so as the core workflow rather than after an explicit opt-in disclosure. Because session images and nearby messages may contain secrets, personal data, or proprietary content, users can unknowingly exfiltrate far more data than expected.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

This request performs the actual external transmission of sensitive payload data to the Anthropic API. While network access is expected for a vision summarization feature, it becomes dangerous here because the payload includes raw image data and potentially sensitive conversational context without strong safeguards or default minimization.

Content

Scanner excerpt · scripts/shrink.py (reported line 385)May include surrounding context.

python

}

        try:
            resp = requests.post(ANTHROPIC_API_URL, headers=headers, json=payload, timeout=30)
            
            # Check if we should failover
            if resp.status_code in FAILOVER_CODES and key_idx < len(api_keys) - 1:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The script permanently rewrites session files with model-generated descriptions, causing sensitive information extracted from images to persist in plain text in local history. That can increase future exposure because data that was previously buried in base64 blobs or images becomes searchable, easier to copy, and may remain even when redaction was not enabled.

Content

Scanner excerpt · scripts/shrink.py (reported line 710)May include surrounding context.

python

if log and verbose:
            print(f"\n💾 Backup saved: {os.path.basename(backup_path)}")

    # Write modified file
    with open(session_file, "w") as f:
        f.writelines(lines)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script automatically harvests Anthropic credentials from both environment variables and local auth profile files, including agent-scoped credentials, without a strong disclosure boundary. This expands the trust surface and can cause the tool to silently use credentials the user did not intend to expose for this operation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.