ClawHub
Back to skill

Security audit

Caveman Compress

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it sends selected memory files to Claude and overwrites persistent agent instruction files with model-generated output, so users should review it carefully before installing.

Install only if you are comfortable sending the full selected memory file to Anthropic/Claude and replacing that file with model-generated compressed text. Prefer running it only by explicit slash command on version-controlled, non-sensitive files, and review the backup and resulting diff before relying on compressed CLAUDE.md in future sessions.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/compress.py:19
Finding

Filename-Only Secret Filtering Allows Sensitive Content to Be Sent to an External API

Content
View full analysis
bool: """Heuristic denylist for files that must never be shipped to a third-party API.""" name = filepath.name if SENSITIVE_BASENAME_REGEX.match(name): return True lowered_parts = {p.lower() for p in filepath.parts} if lowered_parts & SENSITIVE_PATH_COMPONENTS: return True # Normalize separators so "api-key" and "api_key" both match "apikey". lower = re.sub(r"[_\-\s.]", "", name.lower()) return any(tok in lower for tok in SENSITIVE_NAME_TOKENS) ``` ```python def call_claude(prompt: str) -> str: api_key = os.environ.get("ANTHROPIC_API_KEY") if api_key: try: import anthropic client = anthropic.Anthropic(api_key=api_key) ...[truncated 3596 chars]
Remediation
View remediation

T02 · Agent Memory Poisoning

Warning
Location
scripts/validate.py:117
Finding

Weak Validation Permits Untrusted Model Output to Overwrite Persistent Agent Instructions

Content
View full analysis
str: return f""" Compress this markdown into caveman format. STRICT RULES: - Do NOT modify anything inside ``` code blocks - Do NOT modify anything inside inline backticks - Preserve ALL URLs exactly - Preserve ALL headings exactly - Preserve file paths and commands - Return ONLY the compressed markdown body — do NOT wrap the entire output in a ```markdown fence or any other fence. Inner code blocks from the original stay as-is; do not add a new outer fence around the whole file. Only compress natural language. TEXT: {original} """ ``` ```python def validate_headings(orig, comp, result): h1 = extract_headings(orig) h2 = extract_headings(comp) if len(h1) != len(h2): result.add_error(f"Heading count mismatch: {len(h1)} vs {len(h2)}") if h1 != h2: result.add_warning("Heading text/order changed") ``` ```python def validate_paths(orig, comp, result): p1 = extract_paths(orig) p2 = extract_paths(comp) if p1 != p2: result.add_warning(f"Path mismatch: lost={p1 - p2}, added={p2 - p1}") def validate_bullets(orig, comp, result): b1 = count_bullets(orig) b2 = count_bullets(comp) if b1 == 0: return diff = abs(b1 - b2) / b1 if diff > 0.15: result.add_warning(f"Bullet count changed too much: {b1} -> {b2}") ``` ```python def validate(original_path: Path, compressed_path: Path) -> ValidationResult: result = ValidationResult() orig = read_file(original_path) comp = read_file(compressed_path) validate_headings(orig, comp, result) vali ...[truncated 3960 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description is for an active file-compression skill that transforms memory files and writes results back to disk with backups. The supplied code does not compress anything; it only reads existing original/compressed files, measures token savings, runs validation, and prints results. Its primary purpose is benchmarking/testing compression results, which is materially different from the declared operational behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description says the skill compresses memory files and manages backups. The supplied code only classifies files based on extension/content heuristics and returns or prints whether they are suitable for compression. While this detection logic could support a compression workflow, it does not itself carry out the declared primary behavior. Therefore the code chunk materially differs from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description says the skill compresses memory files and writes results back to disk with a backup. The supplied code does none of that. It only reads two files, analyzes markdown-like structure and preserved content, and reports whether the 'compressed' version retains key elements from the original. This is a materially different primary purpose: validation, not compression. There is no file rewriting, no backup creation, and no logic tied to the declared /caveman:compress behavior. While validation could be a supporting component of a compression tool, this code chunk by itself does not implement the declared functionality and instead provides a separate capability.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/compress.py (reported line 21)May include surrounding context.

python
# Filenames and paths that almost certainly hold secrets or PII. Compressing
# them ships raw bytes to the Anthropic API — a third-party data boundary that
# developers on sensitive codebases cannot cross. detect.py already skips .env
# by extension, but credentials.md / secrets.txt / ~/.aws/credentials would
# slip through the natural-language filter. This is a hard refuse before read.
SENSITIVE_BASENAME_REGEX = re.compile(

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/compress.py (reported line 22)May include surrounding context.

python
# Filenames and paths that almost certainly hold secrets or PII. Compressing
# them ships raw bytes to the Anthropic API — a third-party data boundary that
# developers on sensitive codebases cannot cross. detect.py already skips .env
# by extension, but credentials.md / secrets.txt / ~/.aws/credentials would
# slip through the natural-language filter. This is a hard refuse before read.
SENSITIVE_BASENAME_REGEX = re.compile(
    r"(?ix)^("

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/compress.py (reported line 22)May include surrounding context.

python
# Filenames and paths that almost certainly hold secrets or PII. Compressing
# them ships raw bytes to the Anthropic API — a third-party data boundary that
# developers on sensitive codebases cannot cross. detect.py already skips .env
# by extension, but credentials.md / secrets.txt / ~/.aws/credentials would
# slip through the natural-language filter. This is a hard refuse before read.
SENSITIVE_BASENAME_REGEX = re.compile(
    r"(?ix)^("

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/compress.py (reported line 27)May include surrounding context.

python
SENSITIVE_BASENAME_REGEX = re.compile(
    r"(?ix)^("
    r"\.env(\..+)?"
    r"|\.netrc"
    r"|credentials(\..+)?"
    r"|secrets?(\..+)?"
    r"|passwords?(\..+)?"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/detect.py (reported line 14)May include surrounding context.

python
# Extensions that are code/config and should be skipped
SKIP_EXTENSIONS = {
    ".py", ".js", ".ts", ".tsx", ".jsx", ".json", ".yaml", ".yml",
    ".toml", ".env", ".lock", ".css", ".scss", ".html", ".xml",
    ".sql", ".sh", ".bash", ".zsh", ".go", ".rs", ".java", ".c",
    ".cpp", ".h", ".hpp", ".rb", ".php", ".swift", ".kt", ".lua",
    ".dockerfile", ".makefile", ".csv", ".ini", ".cfg",

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/detect.py (reported line 74)May include surrounding context.

python
# Extensions that are code/config and should be skipped
SKIP_EXTENSIONS = {
    ".py", ".js", ".ts", ".tsx", ".jsx", ".json", ".yaml", ".yml",
    ".toml", ".env", ".lock", ".css", ".scss", ".html", ".xml",
    ".sql", ".sh", ".bash", ".zsh", ".go", ".rs", ".java", ".c",
    ".cpp", ".h", ".hpp", ".rb", ".php", ".swift", ".kt", ".lua",
    ".dockerfile", ".makefile", ".csv", ".ini", ".cfg",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README states that the compressed version overwrites the original file and that a backup is created, but it does not prominently warn users that running the skill performs destructive on-disk modification of the specified path. For a tool aimed at memory files that are auto-loaded by an agent, unclear disclosure increases the chance of accidental execution against important project files, causing unintended content changes or workflow disruption even if a backup exists.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill instructs the agent to change directories and run a Python module against an arbitrary absolute file path, implying shell execution plus file read/write behavior, but it declares no tool restrictions or permission scope. In an agent setting, missing explicit tool scoping increases the blast radius if the skill is invoked unexpectedly or modified, because the runtime may allow broader filesystem and shell access than users realize.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly states that the compressed version overwrites the original file, yet it provides no warning or confirmation at invocation time. In an agent environment, destructive file modification without an immediate consent checkpoint creates a real risk of accidental data loss, corruption, or rewriting of sensitive memory/instruction files.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger condition includes a natural-language phrase, "compress memory file," that is broad enough to match ordinary conversation rather than an intentional command. Because the skill can invoke shell commands and overwrite files, accidental activation could cause unintended modification of user memory files or other paths supplied in context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This skill transmits the full contents of local files to Anthropic, either through the SDK or the claude CLI, but the skill description emphasizes local compression, overwrite, and backup behavior rather than third-party transmission. That mismatch is dangerous because users may reasonably invoke it on sensitive memory files without realizing their contents leave the local trust boundary.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The code reads ANTHROPIC_API_KEY and model configuration from the environment and falls back to an external CLI, introducing external-service and credential-dependent behavior not obvious from the manifest's narrow 'compress memory file' framing. This expands the skill's effective capabilities and can surprise users or enterprise operators who expect only local file manipulation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/compress.py (reported line 92)May include surrounding context.

python
pass  # anthropic not installed, fall back to CLI
    # Fallback: use claude CLI (handles desktop auth)
    try:
        result = subprocess.run(
            ["claude", "--print"],
            input=prompt,
            text=True,

Static analysis

No suspicious patterns detected.