context-compression-claude-code

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:32 AM UTC
• Version: 1.0.2

Overview

This context-compression skill is coherent, but it needs review because it can persist conversation-derived memory, including credential or configuration details, without clear consent or secret-redaction safeguards.

Review this skill before installing or enabling hooks. Avoid using it unless memory writes are opt-in, proposed memory changes are shown before saving, secrets are redacted or blocked, and stored memory can be inspected and deleted. I found no evidence of network exfiltration, destructive behavior, or hidden code execution.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:35

Finding

Persistent Plaintext Retention of Credentials and Sensitive Configuration

Content

View full analysis

- ## Compression History ``` ### Technical Analysis The skill explicitly classifies credentials, account information, paths, and configuration as information that must be preserved. It then directs the agent to write high-persistence-value information into a memory file and provides a plaintext field intended to retain account and configuration data across sessions. This design does not distinguish between non-sensitive configuration references and secrets such as passwords, access tokens, private keys, authentication cookies, recovery codes, or embedded credentials. It also does not define redaction, encryption, retention limits, access controls, or user-consent requirements. Persisting credentials is not necessary to perform conversation compression and violates least-privilege and data-minimization principles. Although the audited files contain no network transmission or exfiltration mechanism, persistent plaintext storage expands the period and scope in which disclosed sec ...[truncated 1381 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Warning

• Location: setup-hook.md:29

Finding

Automatic Long-Term Memory Updates Permit Persistent State Poisoning

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly instructs preserving 'key credentials or config' and later writing high-persistence information to a memory file, which encourages durable storage of secrets and sensitive operational details. This materially increases the blast radius of any memory exposure, cross-session leak, or later prompt injection that can read memory, and it violates data-minimization principles.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · setup-hook.md (reported line 11)May include surrounding context.

Claude Code Configuration

Edit ~/.claude/settings.json and add the following configuration:

json

{

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · setup-hook.md (reported line 22)May include surrounding context.

md

"hooks": [
          {
            "type": "command",
            "command": "cat ~/.claude/skills/context-compression/SKILL.md | python3 -c \"import sys,json; content=sys.stdin.read(); print(json.dumps({'hookSpecificOutput': {'hookEventName': 'PreCompact', 'additionalContext': content}}))\"",
            "timeout": 10,
            "statusMessage": "Loading compression strategy..."
          }

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation text triggers on broad conditions like long context, user requests to summarize/clean up, or automatic hooks, which can cause the skill to run in ordinary situations without clear user intent. Because the skill can discard context and persist memory, ambiguous activation increases the chance of unintended data handling and silent loss of important conversation state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description emphasizes preserving important information but does not clearly warn that compression may discard conversation content and write durable memory records. Users and operators may therefore invoke or enable the skill without informed consent about retention and deletion behavior, creating privacy and integrity risks.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Directing the agent to write user preferences, long-term goals, and important decisions into persistent storage creates a durable personal-data trail that may outlive the user's expectations or the original conversation context. Even if intended for continuity, this increases privacy risk, cross-context leakage, and unauthorized reuse if access controls, retention limits, or consent are missing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manual trigger examples ('compress my context', 'context is getting long, clean it up') are common natural-language phrases that may appear in normal conversation, making accidental invocation likely. In a skill that summarizes, drops content, and writes memory, collision with ordinary speech can lead to unintended compression and persistence of user data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The template explicitly encourages storing persistent cross-session information such as accounts, paths, and configuration details, but provides no guardrails about excluding secrets, minimizing retention, obtaining user consent, or handling sensitive personal data. In a context-compression skill, this increases the chance that tokens, credentials, internal file paths, or other sensitive data are silently persisted beyond the immediate conversation and later exposed or misused.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · setup-hook.md (reported line 22)May include surrounding context.

md

"hooks": [
          {
            "type": "command",
            "command": "cat ~/.claude/skills/context-compression/SKILL.md | python3 -c \"import sys,json; content=sys.stdin.read(); print(json.dumps({'hookSpecificOutput': {'hookEventName': 'PreCompact', 'additionalContext': content}}))\"",
            "timeout": 10,
            "statusMessage": "Loading compression strategy..."
          }

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The PostCompact prompt instructs the agent to update a user memory file with preferences, incomplete tasks, and decisions, but provides no warning or consent mechanism for modifying persistent user data. This can cause silent retention of sensitive or context-derived information beyond the current session, creating privacy and data governance risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This prompt explicitly directs the agent to persist user-provided and conversation-derived details into a memory file in plain language. In the context of a compression skill, this is more dangerous because the action is coupled to an automated lifecycle hook, making silent long-term storage of potentially sensitive material more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The OpenClaw post-compaction configuration directs the agent to write user preferences, incomplete tasks, and important decisions to a memory file without a user-visible warning. Because this persistence is embedded in hook behavior, it may happen automatically and opaquely, increasing privacy and retention risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The OpenClaw hook prompt tells the agent to record user-related and session-derived information into a memory file after compression. Because it is part of an automatic hook chain, users may not realize their data is being persisted, which raises privacy and unintended retention concerns.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manual invocation examples use broad, ordinary phrases like 'clean up conversation history' and 'organize it' that can match benign user requests and trigger compression unexpectedly. In a skill that can alter context handling and lead to persistence workflows, ambiguous activation increases the chance of unintended execution and downstream data modification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.