Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

mar-context-compression

v1.0.0

This skill should be used when the user asks to "compress context", "summarize conversation history", "implement compaction", "reduce token usage", or mentio...

0· 72·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for marjoriebroad/mar-context-compression.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "mar-context-compression" (marjoriebroad/mar-context-compression) from ClawHub.
Skill page: https://clawhub.ai/marjoriebroad/mar-context-compression
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install mar-context-compression

ClawHub CLI

Package manager switcher

npx clawhub@latest install mar-context-compression
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill claims to be an instruction-only context-compression helper, but the bundle includes a Python evaluator that calls an external LLM judge endpoint and reads SKILLBOSS_API_KEY from the environment. The SKILL.md and metadata declare no required credentials or external API usage, so the presence of an external API client and hidden credential requirement is disproportionate to the stated purpose and not documented.
!
Instruction Scope
SKILL.md focuses on summarization strategies and probe evaluations but does not instruct the agent to call external services or require credentials. The Python script, however, will transmit probe data, compressed context, and responses to https://api.heybossai.com/v1/pilot using the SKILLBOSS_API_KEY. That means conversation history and artifact descriptions could leave the host if the script runs — this behavior is not described or justified in the SKILL.md.
Install Mechanism
There is no install spec (lower risk from arbitrary downloads), but the included script requires the 'requests' library and network access. Because no install/runtime environment is declared, running the script may fail or unexpectedly attempt network calls. Lack of a declared runtime or dependency list is sloppy and increases operational risk.
!
Credentials
The Python code reads os.environ['SKILLBOSS_API_KEY'] but the skill metadata lists no required env vars or primary credential. Requesting a bearer API key for a third-party service is not proportional to the documented scope unless the skill explicitly states that it will outsource evaluation to that service. Hidden credential requirements create risk of accidental credential reuse or exposure.
Persistence & Privilege
The skill is not always-enabled and does not request system-wide persistent privileges. It does not modify other skills' configs in the provided files. The main concern is outbound network activity rather than elevated platform privileges.
Scan Findings in Context
[env-var-SKILLBOSS_API_KEY] unexpected: The script directly accesses SKILLBOSS_API_KEY from the environment but the skill metadata and SKILL.md do not declare any required credentials. If the skill needs this key, it should be declared and justified; as-is it's a hidden credential requirement.
[network-call-to-api.heybossai.com] unexpected: The code posts probe and evaluation data to https://api.heybossai.com/v1/pilot. The SKILL.md does not mention sending conversation history or compressed context to an external service, so this outbound transmission is unexpected and may leak sensitive content.
What to consider before installing
Do not install or run this skill until the author clarifies and documents external-network behavior and credentials. Specifically: (1) ask the author to explain why SKILLBOSS_API_KEY and calls to api.heybossai.com are required and what data is sent; (2) request that required env vars be declared in the skill metadata and that a privacy/security policy be provided; (3) review the compression_evaluator.py code yourself (or have a trusted engineer do so) to confirm no additional endpoints or hidden behaviors exist; (4) if you must test, run the skill in a sandboxed environment without any sensitive credentials and monitor outbound network traffic; and (5) consider removing or replacing the external-API calls if you prefer an offline/local evaluation option.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ed5rz7xkb40kqzh23186b2d85dt18
72downloads
0stars
1versions
Updated 5d ago
v1.0.0
MIT-0

Context Compression Strategies

When agent sessions generate millions of tokens of conversation history, compression becomes mandatory. The naive approach is aggressive compression to minimize tokens per request. The correct optimization target is tokens per task: total tokens consumed to complete a task, including re-fetching costs when compression loses critical information.

When to Activate

Activate this skill when:

  • Agent sessions exceed context window limits
  • Codebases exceed context windows (5M+ token systems)
  • Designing conversation summarization strategies
  • Debugging cases where agents "forget" what files they modified
  • Building evaluation frameworks for compression quality

Core Concepts

Context compression trades token savings against information loss. Three production-ready approaches exist:

  1. Anchored Iterative Summarization: Maintain structured, persistent summaries with explicit sections for session intent, file modifications, decisions, and next steps. When compression triggers, summarize only the newly-truncated span and merge with the existing summary. Structure forces preservation by dedicating sections to specific information types.

  2. Opaque Compression: Produce compressed representations optimized for reconstruction fidelity. Achieves highest compression ratios (99%+) but sacrifices interpretability. Cannot verify what was preserved.

  3. Regenerative Full Summary: Generate detailed structured summaries on each compression. Produces readable output but may lose details across repeated compression cycles due to full regeneration rather than incremental merging.

The critical insight: structure forces preservation. Dedicated sections act as checklists that the summarizer must populate, preventing silent information drift.

Detailed Topics

Why Tokens-Per-Task Matters

Traditional compression metrics target tokens-per-request. This is the wrong optimization. When compression loses critical details like file paths or error messages, the agent must re-fetch information, re-explore approaches, and waste tokens recovering context.

The right metric is tokens-per-task: total tokens consumed from task start to completion. A compression strategy saving 0.5% more tokens but causing 20% more re-fetching costs more overall.

The Artifact Trail Problem

Artifact trail integrity is the weakest dimension across all compression methods, scoring 2.2-2.5 out of 5.0 in evaluations. Even structured summarization with explicit file sections struggles to maintain complete file tracking across long sessions.

Coding agents need to know:

  • Which files were created
  • Which files were modified and what changed
  • Which files were read but not changed
  • Function names, variable names, error messages

This problem likely requires specialized handling beyond general summarization: a separate artifact index or explicit file-state tracking in agent scaffolding.

Structured Summary Sections

Effective structured summaries include explicit sections:

## Session Intent
[What the user is trying to accomplish]

## Files Modified
- auth.controller.ts: Fixed JWT token generation
- config/redis.ts: Updated connection pooling
- tests/auth.test.ts: Added mock setup for new config

## Decisions Made
- Using Redis connection pool instead of per-request connections
- Retry logic with exponential backoff for transient failures

## Current State
- 14 tests passing, 2 failing
- Remaining: mock setup for session service tests

## Next Steps
1. Fix remaining test failures
2. Run full test suite
3. Update documentation

This structure prevents silent loss of file paths or decisions because each section must be explicitly addressed.

Compression Trigger Strategies

When to trigger compression matters as much as how to compress:

StrategyTrigger PointTrade-off
Fixed threshold70-80% context utilizationSimple but may compress too early
Sliding windowKeep last N turns + summaryPredictable context size
Importance-basedCompress low-relevance sections firstComplex but preserves signal
Task-boundaryCompress at logical task completionsClean summaries but unpredictable timing

The sliding window approach with structured summaries provides the best balance of predictability and quality for most coding agent use cases.

Probe-Based Evaluation

Traditional metrics like ROUGE or embedding similarity fail to capture functional compression quality. A summary may score high on lexical overlap while missing the one file path the agent needs.

Probe-based evaluation directly measures functional quality by asking questions after compression:

Probe TypeWhat It TestsExample Question
RecallFactual retention"What was the original error message?"
ArtifactFile tracking"Which files have we modified?"
ContinuationTask planning"What should we do next?"
DecisionReasoning chain"What did we decide about the Redis issue?"

If compression preserved the right information, the agent answers correctly. If not, it guesses or hallucinates.

Evaluation Dimensions

Six dimensions capture compression quality for coding agents:

  1. Accuracy: Are technical details correct? File paths, function names, error codes.
  2. Context Awareness: Does the response reflect current conversation state?
  3. Artifact Trail: Does the agent know which files were read or modified?
  4. Completeness: Does the response address all parts of the question?
  5. Continuity: Can work continue without re-fetching information?
  6. Instruction Following: Does the response respect stated constraints?

Accuracy shows the largest variation between compression methods (0.6 point gap). Artifact trail is universally weak (2.2-2.5 range).

Practical Guidance

Three-Phase Compression Workflow

For large codebases or agent systems exceeding context windows, apply compression through three phases:

  1. Research Phase: Produce a research document from architecture diagrams, documentation, and key interfaces. Compress exploration into a structured analysis of components and dependencies. Output: single research document.

  2. Planning Phase: Convert research into implementation specification with function signatures, type definitions, and data flow. A 5M token codebase compresses to approximately 2,000 words of specification.

  3. Implementation Phase: Execute against the specification. Context remains focused on the spec rather than raw codebase exploration.

Using Example Artifacts as Seeds

When provided with a manual migration example or reference PR, use it as a template to understand the target pattern. The example reveals constraints that static analysis cannot surface: which invariants must hold, which services break on changes, and what a clean migration looks like.

This is particularly important when the agent cannot distinguish essential complexity (business requirements) from accidental complexity (legacy workarounds). The example artifact encodes that distinction.

Implementing Anchored Iterative Summarization

  1. Define explicit summary sections matching your agent's needs
  2. On first compression trigger, summarize truncated history into sections
  3. On subsequent compressions, summarize only new truncated content
  4. Merge new summary into existing sections rather than regenerating
  5. Track which information came from which compression cycle for debugging

When to Use Each Approach

Use anchored iterative summarization when:

  • Sessions are long-running (100+ messages)
  • File tracking matters (coding, debugging)
  • You need to verify what was preserved

Use opaque compression when:

  • Maximum token savings required
  • Sessions are relatively short
  • Re-fetching costs are low

Use regenerative summaries when:

  • Summary interpretability is critical
  • Sessions have clear phase boundaries
  • Full context review is acceptable on each compression

Compression Ratio Considerations

MethodCompression RatioQuality ScoreTrade-off
Anchored Iterative98.6%3.70Best quality, slightly less compression
Regenerative98.7%3.44Good quality, moderate compression
Opaque99.3%3.35Best compression, quality loss

The 0.7% additional tokens retained by structured summarization buys 0.35 quality points. For any task where re-fetching costs matter, this trade-off favors structured approaches.

Examples

Example 1: Debugging Session Compression

Original context (89,000 tokens, 178 messages):

  • 401 error on /api/auth/login endpoint
  • Traced through auth controller, middleware, session store
  • Found stale Redis connection
  • Fixed connection pooling, added retry logic
  • 14 tests passing, 2 failing

Structured summary after compression:

## Session Intent
Debug 401 Unauthorized error on /api/auth/login despite valid credentials.

## Root Cause
Stale Redis connection in session store. JWT generated correctly but session could not be persisted.

## Files Modified
- auth.controller.ts: No changes (read only)
- middleware/cors.ts: No changes (examined)
- config/redis.ts: Fixed connection pooling configuration
- services/session.service.ts: Added retry logic for transient failures
- tests/auth.test.ts: Updated mock setup

## Test Status
14 passing, 2 failing (mock setup issues)

## Next Steps
1. Fix remaining test failures (mock session service)
2. Run full test suite
3. Deploy to staging

Example 2: Probe Response Quality

After compression, asking "What was the original error?":

Good response (structured summarization):

"The original error was a 401 Unauthorized response from the /api/auth/login endpoint. Users received this error with valid credentials. Root cause was stale Redis connection in session store."

Poor response (aggressive compression):

"We were debugging an authentication issue. The login was failing. We fixed some configuration problems."

The structured response preserves endpoint, error code, and root cause. The aggressive response loses all technical detail.

Guidelines

  1. Optimize for tokens-per-task, not tokens-per-request
  2. Use structured summaries with explicit sections for file tracking
  3. Trigger compression at 70-80% context utilization
  4. Implement incremental merging rather than full regeneration
  5. Test compression quality with probe-based evaluation
  6. Track artifact trail separately if file tracking is critical
  7. Accept slightly lower compression ratios for better quality retention
  8. Monitor re-fetching frequency as a compression quality signal

Integration

This skill connects to several others in the collection:

  • context-degradation - Compression is a mitigation strategy for degradation
  • context-optimization - Compression is one optimization technique among many
  • evaluation - Probe-based evaluation applies to compression testing
  • memory-systems - Compression relates to scratchpad and summary memory patterns

References

Internal reference:

Related skills in this collection:

  • context-degradation - Understanding what compression prevents
  • context-optimization - Broader optimization strategies
  • evaluation - Building evaluation frameworks

External resources:

  • Factory Research: Evaluating Context Compression for AI Agents (December 2025)
  • Research on LLM-as-judge evaluation methodology (Zheng et al., 2023)
  • Netflix Engineering: "The Infinite Software Crisis" - Three-phase workflow and context compression at scale (AI Summit 2025)

Skill Metadata

Created: 2025-12-22 Last Updated: 2025-12-26 Author: Agent Skills for Context Engineering Contributors Version: 1.1.0

Comments

Loading comments...