Security audit

Context Compressor

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a context-compression helper, but it has enough mismatched purpose text, broad file authority, persistence, and under-described external callback behavior that users should review it before installing.

Install only if you are comfortable with an agent reading and writing local log files, creating classified archives and cache/history files, and potentially using callback URLs. Review output paths, avoid sensitive logs unless needed, and require explicit approval before batch runs, exports, scheduled jobs, or any callback destination.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The manifest/description says this skill should be used for translation and localization, but the rest of the document implements context compression, file operations, and shell-driven workflows. This mismatch can cause users or orchestrators to invoke the skill under the wrong trust assumptions, increasing the chance of unintended file changes, data handling, or command execution.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: Conflicting documentation about the skill's purpose is security-relevant because operators may grant permissions or route sensitive content based on the wrong use case. In this file, the stated translation purpose is much narrower and lower-risk than the actual compression/archive/history behavior, which includes retention and export of conversation-derived data.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill documents commands and workflows that write files, classify logs into directories, and export history, but it does not prominently warn users that these actions modify local data and may execute shell commands. In an agent setting, weak disclosure of side effects can lead to silent workspace changes, accidental overwrites, or unsafe automation.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documented callback_url parameter implies sending processing results to an external endpoint, but there is no clear privacy or egress warning. Because this skill processes conversation-derived logs and classifications, an arbitrary callback target could exfiltrate sensitive content or metadata outside the trusted environment.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The compression and classification design explicitly retains conversation-derived categories such as decisions, facts, and preferences, which can contain sensitive personal or operational information. Structuring and preserving this data makes it easier to search, export, and unintentionally disclose than leaving it in raw transient context.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The history feature records every compression operation and supports exporting derived reports, creating a durable audit trail of filenames, sizes, categories, timestamps, and potentially sensitive workflow metadata. In aggregate, these logs can reveal user behavior, project structure, and conversation-derived content patterns even if raw text is not fully stored.

Static analysis

No suspicious patterns detected.