Security audit
Security checks for vulnerabilities and agentic risk
The skill is a Chinese guide for compressing local agent memory logs, with disclosed memory-file writes but no evidence of hidden upload, persistence, or destructive behavior.
Before installing, treat this as a local-memory editing workflow: review generated summaries before appending them to MEMORY.md, keep original logs or backups, and separately inspect any context-compressor.js script you obtain because it is not included in this artifact.
The scenario recommends replacing original logs with compressed output via mv, which can destroy the only full-fidelity record without warning about irreversibility, validation, or backup. In this skill’s context, the source material is agent memory/history, so data loss can remove auditability, debugging context, and evidence needed to recover from bad summaries or compromised outputs.
The skill instructs the agent to append generated output directly into persistent memory files using shell redirection, without any explicit backup, preview, or confirmation step. Because the tool is allowed to use exec and operates on long-lived agent state, malformed compression output or prompt-influenced content could permanently pollute MEMORY.md and degrade future agent behavior.
The file explicitly states '完全中文化表达，适配中文用户工作流', which indicates an intentional language constraint. There is no accompanying note that users may choose another language or locale, so this is a natural-language policy issue under the language/locale rule.
L275-L278 明确说明该免费版基于本地脚本运行且不上传数据，传达出无需网络参与的意图；但 L339 又将“网络错误”列为运行场景，并要求执行 ping 测试网络、检查防火墙和代理。这与前述“本地完成、无需网络”的文档意图形成直接矛盾。
