Huizai Context Optimizer

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:11 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent context-compression guide with a local evaluation helper, and I found no hidden execution, exfiltration, persistence, or destructive behavior.

Install this only if you want guidance or helper code for context compression and evaluation. Be mindful that evaluating real conversation history may expose file names, errors, and decisions to whatever process or model you choose to connect later; the shipped helper itself is local and stubbed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The description starts with several specific phrases but then expands activation to any request that 'mentions context compression, structured summarization, tokens-per-task optimization, or long-running agent sessions exceeding context limits.' Those latter conditions are broad topic mentions rather than clear invocation triggers, which could cause the skill to activate during general discussion instead of when the user actually wants this skill applied.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

# Context Compression Strategies

When agent sessions generate millions of tokens of conversation history, compression becomes mandatory. The naive approach is aggressive compression to minimize tokens per request. The correct optimization target is tokens per task: total tokens consumed to complete a task, including re-fetching costs when compression loses critical information.

## When to Activate

• Confidence: 80% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

## When to Activate

Activate this skill when:
- Agent sessions exceed context window limits
- Codebases exceed context windows (5M+ token systems)
- Designing conversation summarization strategies
- Debugging cases where agents "forget" what files they modified

• Confidence: 80% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

## When to Activate

Activate this skill when:
- Agent sessions exceed context window limits
- Codebases exceed context windows (5M+ token systems)
- Designing conversation summarization strategies
- Debugging cases where agents "forget" what files they modified

• Confidence: 80% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The description is written entirely in Chinese and does not indicate that the skill supports other languages, offers a language choice, or is intentionally limited to a Chinese-speaking audience. Under the policy, language-specific behavior should be opt-in or clearly justified when a locale constraint exists.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: This code ingests raw conversation history and extracts errors, file paths, and decision details, which may include sensitive user or system information. There is no confirmation prompt, visible disclosure, or explicit warning in the code that such session content will be inspected for evaluation purposes.

Static analysis

No suspicious patterns detected.