Compress

• Outcome: Pass
• Latest audit: Jun 26, 2026 · 4:54 PM UTC
• Version: 1.0.0

Overview

This skill does what it claims: compresses a selected memory file with Claude, backs it up, and does not show hidden persistence or credential theft.

Install only if you are comfortable sending the selected markdown/text memory file to Claude/Anthropic. Use it on non-sensitive notes, invoke it with an explicit filepath, and keep the generated .original.md backup until you have reviewed the compressed result.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill invokes Python, shell, and file read/write operations but does not declare those capabilities or permissions. Hidden execution and filesystem access reduce user visibility and policy enforcement, making it easier for the skill to modify files or access environment data in ways the user did not clearly authorize.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The stated description omits materially important behavior, including sending file contents to an external Claude/Anthropic service, performing extra validation/retry flows, and applying hidden refusal logic. This is dangerous because users may provide sensitive memory files believing processing is local-only, when in fact the contents may be exfiltrated to a third party and subjected to additional undocumented handling.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The skill is described as compressing local memory files, but the implementation sends full file contents to Anthropic via SDK or CLI. That creates a third-party data transfer boundary that users may not expect from the description, which can expose sensitive notes, project metadata, or internal documentation.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code reads `ANTHROPIC_API_KEY` and falls back to an external Claude CLI, expanding the skill's capabilities beyond simple local file rewriting. While this is functionally related to LLM-based compression, it materially changes the trust model by using external authenticated services and should be treated as a privacy/security-relevant behavior.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger condition includes broad natural-language phrasing such as 'compress memory file,' which may activate on ordinary conversation rather than a deliberate tool invocation. In this skill, accidental activation is more dangerous because the workflow can overwrite files and transmit their contents externally.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Although the skill mentions that the compressed version overwrites the original and saves a backup, the warning is not prominent or explicit enough for a destructive operation. Because the target is user memory files, accidental overwrite can cause loss of readability, workflow disruption, or corruption if compression/validation behaves unexpectedly.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def call_claude(prompt: str) -> str:
    api_key = os.environ.get("ANTHROPIC_API_KEY")
    if api_key:
        try:
            import anthropic

• Confidence: 70% confidence
• Finding: os.environ.get("ANTHROPIC_API_KEY

Unvalidated Output Injection

High

• Category: Output Handling

Content

pass  # anthropic not installed, fall back to CLI
    # Fallback: use claude CLI (handles desktop auth)
    try:
        result = subprocess.run(
            ["claude", "--print"],
            input=prompt,
            text=True,

• Confidence: 95% confidence
• Finding: subprocess.run( ["claude", "--print"], input=prompt, text=True, capture_output

Credential Access

High

• Category: Privilege Escalation

Content

# Filenames and paths that almost certainly hold secrets or PII. Compressing
# them ships raw bytes to the Anthropic API — a third-party data boundary that
# developers on sensitive codebases cannot cross. detect.py already skips .env
# by extension, but credentials.md / secrets.txt / ~/.aws/credentials would
# slip through the natural-language filter. This is a hard refuse before read.
SENSITIVE_BASENAME_REGEX = re.compile(
    r"(?ix)^("

• Confidence: 90% confidence
• Finding: ~/.aws/credentials

Credential Access

High

• Category: Privilege Escalation

Content

SENSITIVE_BASENAME_REGEX = re.compile(
    r"(?ix)^("
    r"\.env(\..+)?"
    r"|\.netrc"
    r"|credentials(\..+)?"
    r"|secrets?(\..+)?"
    r"|passwords?(\..+)?"

• Confidence: 80% confidence
• Finding: .netrc

Credential Access

High

• Category: Privilege Escalation

Content

# Filenames and paths that almost certainly hold secrets or PII. Compressing
# them ships raw bytes to the Anthropic API — a third-party data boundary that
# developers on sensitive codebases cannot cross. detect.py already skips .env
# by extension, but credentials.md / secrets.txt / ~/.aws/credentials would
# slip through the natural-language filter. This is a hard refuse before read.
SENSITIVE_BASENAME_REGEX = re.compile(
    r"(?ix)^("

• Confidence: 70% confidence
• Finding: secrets.txt

Credential Access

High

• Category: Privilege Escalation

Content

# Filenames and paths that almost certainly hold secrets or PII. Compressing
# them ships raw bytes to the Anthropic API — a third-party data boundary that
# developers on sensitive codebases cannot cross. detect.py already skips .env
# by extension, but credentials.md / secrets.txt / ~/.aws/credentials would
# slip through the natural-language filter. This is a hard refuse before read.
SENSITIVE_BASENAME_REGEX = re.compile(

• Confidence: 60% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

# Extensions that are code/config and should be skipped
SKIP_EXTENSIONS = {
    ".py", ".js", ".ts", ".tsx", ".jsx", ".json", ".yaml", ".yml",
    ".toml", ".env", ".lock", ".css", ".scss", ".html", ".xml",
    ".sql", ".sh", ".bash", ".zsh", ".go", ".rs", ".java", ".c",
    ".cpp", ".h", ".hpp", ".rb", ".php", ".swift", ".kt", ".lua",
    ".dockerfile", ".makefile", ".csv", ".ini", ".cfg",

• Confidence: 60% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

if ext in COMPRESSIBLE_EXTENSIONS:
        return "natural_language"
    if ext in SKIP_EXTENSIONS:
        return "code" if ext not in {".json", ".yaml", ".yml", ".toml", ".ini", ".cfg", ".env"} else "config"

    # Extensionless files (like CLAUDE.md, TODO) — check content
    if not ext:

• Confidence: 60% confidence
• Finding: .env"

VirusTotal

61/61 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.