ClawHub
Back to skill

Security audit

Agent-Skills-for-Context-Engineering

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent context-compression guide with a local demonstration script and no automatic network access, persistence, or hidden privileged behavior.

Installers should treat this as a benign educational and evaluation aid. Be careful before adapting the documented LLM-judge example for real conversations, because compressed context can contain private code, file paths, secrets, or user data; add consent, redaction, and provider review before any remote judging.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description says the skill should be used when the user asks to "compress context" or "summarize conversation history," and also when they merely mention broad concepts like "tokens-per-task optimization" or "long-running agent sessions exceeding context limits." Several of these phrases are common discussion topics rather than clear invocation commands, which makes the trigger scope ambiguous and risks unintended activation.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
# Context Compression Strategies

When agent sessions generate millions of tokens of conversation history, compression becomes mandatory. The naive approach is aggressive compression to minimize tokens per request. The correct optimization target is tokens per task: total tokens consumed to complete a task, including re-fetching costs when compression loses critical information.

## When to Activate

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
## When to Activate

Activate this skill when:
- Agent sessions exceed context window limits
- Codebases exceed context windows (5M+ token systems)
- Designing conversation summarization strategies
- Debugging cases where agents "forget" what files they modified

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
## When to Activate

Activate this skill when:
- Agent sessions exceed context window limits
- Codebases exceed context windows (5M+ token systems)
- Designing conversation summarization strategies
- Debugging cases where agents "forget" what files they modified

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented production path sends probe content, model responses, and compressed context to an external LLM judge API. In this skill, those inputs are derived from full conversation history and may contain sensitive user data, file paths, code, or secrets, yet there is no consent flow, redaction step, or visibility to the user that this data may leave the local/system boundary. Because this is a context-compression evaluator, the evaluated material is especially likely to include broad slices of prior conversation, increasing the chance of privacy or data-handling violations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.