3-Layer Token Compressor — Cut AI API Costs 40-60%

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:36 PM UTC
• Version: 1.1.0

Overview

This skill mostly does what it advertises, but it needs review because it can send prompts and conversation history to a configurable HTTP host while the documentation promises localhost-only processing.

Review before installing in sensitive workflows. Only configure ollamaHost to a trusted loopback address, avoid using it with secrets or regulated data unless you trust the local model/service and its logs, and be aware that compressed summaries can distort or inject context into later model calls.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: src/token-compressor.js:17

Finding

Configurable Plaintext Endpoint Can Expose Sensitive Conversation Data

Content

View full analysis

{ const body = JSON.stringify({ model: this.compressionModel, messages: [ { role: 'system', content: 'You are a text compression tool. Output only what is asked, nothing else. No explanations, no preamble.' }, { role: 'user', content: prompt } ], stream: false, options: { temperature: 0.1, // Low creativity — we want faithful compression num_predict: 512 // Cap output length } }); const req = http.request({ hostname: this.ollamaHost, port: this.ollamaPort, path: '/api/chat', method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) }, timeout: 15000 // 15s max — if Ollama is slow, skip compression }, (res) => { let data = ''; res.on('data', chunk => data += chunk); res.on('end', () => { try { const parsed = JSON.parse(data); resolve(parsed.message?.content?.trim() || null); } catch { reject(new Error('Invalid Ollama response')); } }); }); req.on('error', reject); req.on('timeout', () => { req.destroy(); reject(new Error('Ollama timeout')); }); req.write(body); req.end(); }); } ``` ### Technical Analysis The endpoint hostname and port are accepted directly from caller-controlled configuration. The implementation does not verify that the resolved destination is a loopback address or an approved local Ollama service. Both `compressMessage()` and `compressHistory()` place potentially ...[truncated 2168 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/token-compressor.js:98

Finding

Prompt Injection Through Untrusted Content Can Poison Compressed Context

Content

View full analysis

this.compressedTurnCount) { try { const turnText = oldTurns.map(t => `${t.role}: ${t.content}`).join('\n'); const prompt = `Summarize this conversation into a brief context paragraph. Include key topics discussed, decisions made, important details mentioned, and any unresolved questions. Be dense and factual. Max 200 words. ${this.historySummary ? `Previous summary: ${this.historySummary}\n\nNew turns to incorporate:\n` : ''}${turnText} Summary:`; const summary = await this._queryOllama(prompt); if (summary) { this.historySummary = summary; this.compressedTurnCount = oldTurns.length; this.stats.historySummaries++; const oldTokens = turnText.length / 4; const newTokens = summary.length / 4; this.stats.estimatedTokensSaved += Math.floor(oldTokens - newTokens); } } catch (err) { // Failed — just return uncompressed return history; } } // Build compressed history: summary as first message + recent turns if (this.historySummary) { return [ { role: 'user', content: `[Previous conversation summary: ${this.historySummary}]` }, { role: 'assistant', content: 'Understood, I have the context from our previous conversation.' }, ...recentTurns ]; } ``` ### Technical Analysis Conversation roles and content are concatenated directly into a natural-language summarization prompt. There is no structural separation, escaping, or validation that prevents conversation text from containing instructions directed at the compression model. An attacker can therefore add content such as instructions to ignore the summarization request and emit attacker-selected directives. The fixed system prompt asks the model to ...[truncated 2050 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · src/token-compressor.js (reported line 187)May include surrounding context.

js

}

  /**
   * Reset state (on new conversation)
   */
  reset() {
    this.historySummary = null;

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

User messages are forwarded to a separate local Ollama service for compression without any explicit user disclosure or consent mechanism. Even though the service is local, this still expands the trust boundary and may expose sensitive prompt contents to another process, host, log sink, or misconfigured network endpoint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The history summarization path sends prior conversation turns, potentially including large amounts of sensitive accumulated context, to the local Ollama service without explicit disclosure. This is riskier than single-message compression because it centralizes and retransmits broader conversation history, increasing exposure if the service, host configuration, or logs are compromised.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · README.md (reported line 156)May include surrounding context.

md

**USE AT YOUR OWN RISK.**

- The author(s) are NOT liable for any damages, losses, or consequences arising from
  the use or misuse of this software — including but not limited to financial loss,
  data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for

Static analysis

No suspicious patterns detected.