Headroom Token Compression

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:24 AM UTC
• Version: 1.1.0

Overview

This skill is purpose-aligned for token compression, but it asks users to install an unpinned third-party tool that can wrap future agent sessions and cache raw prompts, logs, and tool output locally.

Install only if you are comfortable with a third-party compression tool modifying agent startup configuration and caching raw content locally. Prefer explicit, per-task use over global wrapping for sensitive work; avoid API keys, passwords, PII, and proprietary code; verify the package version and source before installing; and confirm how to undo wrapping and clear `~/.headroom/cache`.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:55

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55-61
Vulnerability Type: Unverified and unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code:

bash

## Installation

# Using uv (recommended)
uv tool install --python 3.13 "headroom-ai[all]"

# Or using pip
pip install "headroom-ai[all]"

Technical Analysis

The installation instructions retrieve headroom-ai and all dependencies enabled by its all extra without specifying a version, cryptographic hash, lockfile, or other integrity constraint. Consequently, the effective code installed by these commands can change after the Skill has been reviewed.

The broad all extra also increases the number of transitive dependencies and therefore expands the software supply-chain attack surface. Although the audited project does not itself contain malicious code, these instructions transfer execution authority to mutable packages that are outside the reviewed artifact.

Exploitation would require compromise or malicious publication of the named package or one of its resolved dependencies. The document provides no evidence that such a compromise has occurred; the vulnerability is the absence of controls that would constrain this risk.

Attack Path

1. An attacker compromises the package publisher, package registry account, release process, or a transitive dependency.
2. The attacker publishes a malicious version that still satisfies the unrestricted package requirement.
3. A user follows the documented uv tool install or pip install command.
4. The package manager resolves and installs the attacker-controlled release.
5. Malicious package code executes during installation or when the installed headroom command is invoked, with the permissions of the user running it.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the installing user's privileges. Depending on that user's ...[truncated 317 chars]

Remediation

View remediation

Remediation Suggestions

• Pin headroom-ai to a specifically reviewed version rather than accepting the latest available release.
• Use a lockfile or requirements file containing cryptographic hashes for the package and all transitive dependencies.
• Prefer a minimal dependency extra instead of [all] when only a subset of features is required.
• Verify the package publisher, registry origin, release signatures, and published checksums before installation.
• Audit the resolved dependency tree and incorporate dependency vulnerability and provenance checks into the release process.
• Install the package in an isolated environment with minimal filesystem, credential, and network access.
• Document the exact version and integrity information verified during the Skill audit.

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:65

Finding

Agent Tool Interposition Through Startup Configuration Wrapping

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 65-79
Vulnerability Type: Third-party wrapping and modification of agent startup configuration
Risk Level: High

Vulnerable Code:

bash

### 1. One-Click Deploy (Simplest)
```bash
headroom deploy

Automatically configures local deployment and agent integration.

2. Wrap Common Agents

bash

# Wrap Claude Code
headroom wrap claude

# Wrap Codex
headroom wrap codex

# Wrap OpenCode
headroom wrap opencode

Use headroom unwrap <tool> to remove wrapping.

text

The document immediately further states that wrap operations modify agent startup configuration.

### Technical Analysis

The instructions authorize an externally installed tool to wrap legitimate AI-agent executables and modify their startup configuration. This places the wrapper in the execution and data path of future Claude Code, Codex, or OpenCode sessions. A wrapper operating in that position may observe or alter prompts, tool outputs, logs, model requests, and responses while calls still appear to target the original agent.

The implementation responsible for these modifications is not included in the audited project, so the exact files changed, interception boundaries, validation controls, and rollback behavior cannot be verified from the artifact. The documented `unwrap` command offers a rollback mechanism, but the Skill does not establish that all changes are enumerated, backed up, integrity-checked, or fully restored.

This is a tool-hijacking risk rather than proof that Headroom is malicious. Exploitation requires malicious or compromised wrapper code, or unsafe behavior in the external dependency installed by the user.

### Attack Path

1. The user installs the externally maintained `headroom` package.
2. The user runs `headroom deploy` or a `headroom wrap` command as instructed.
3. The external program modifies agent startup configuration and int
...[truncated 1053 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer explicit, per-command compression that does not alter startup configuration or globally wrap trusted tools.
• Before applying changes, display every file, environment variable, executable path, alias, and configuration entry that will be modified.
• Require explicit user confirmation for each affected agent and create timestamped backups of all configuration files.
• Pin and integrity-verify the wrapper implementation and its dependencies.
• Run the wrapper with least privilege and restrict its access to credentials, sensitive directories, and unnecessary network destinations.
• Provide a documented manual rollback procedure in addition to headroom unwrap, including expected before-and-after configuration states.
• Add a verification command that confirms the original executable path and configuration have been completely restored.
• Avoid processing secrets, proprietary code, PII, or other sensitive content through the wrapper, consistent with the Skill's existing privacy warning.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep