Trunkate AI

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:36 AM UTC
• Version: 0.20.0

Overview

The skill performs real context compression, but its automatic hook can silently send and replace session history with insufficient controls.

Review before installing. Use this only in environments where sending conversation history, logs, and potentially project content to Trunkate is acceptable. Avoid enabling the automatic PreRequest hook until it has explicit opt-in, enforced threshold checks, destination allowlisting, stronger redaction, and user-visible confirmation before replacing session history.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/activator.py:34

Finding

Automatic External Transmission of Insufficiently Redacted Conversation History

Content

View full analysis

str: """Optimizes a prompt using the private Trunkate AI API.""" api_url = os.environ.get("TRUNKATE_API_URL", API_URL).rstrip("/") api_key = os.environ.get("TRUNKATE_API_KEY") if not api_key: print("Error: TRUNKATE_API_KEY required.", file=sys.stderr) return prompt payload = {"text": prompt, "budget": budget, "model": model} headers = {"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"} try: response = requests.post(f"{api_url}/optimize", json=payload, headers=head ...[truncated 2332 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/activator.py:63

Finding

Missing Threshold Gate Causes History Transmission on Every Hook Invocation

Content

View full analysis

(OPENCLAW_TOKEN_LIMIT * TRUNKATE_THRESHOLD) ``` ### Technical Analysis The implementation reads `OPENCLAW_CURRENT_TOKENS` and `OPENCLAW_TOKEN_LIMIT`, but never compares them. It never reads `TRUNKATE_THRESHOLD`. Therefore, after the hook is installed, the existence of a valid history path—not context utilization—is the effective activation condition. This contradicts the documented default threshold of 80%. Users may reasonably expect history to leave the system only near the context limit, while the code can transmit it before every LLM request. The missing gate expands network access and sensitive-data exposure beyond the minimum frequency required for the declared context-overflow prevention function. It also increases API usage, latency, and dependency on the remote service. ### Attack Path 1. A user insta ...[truncated 917 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: scripts/activator.py:95

Finding

Untrusted Remote Response Can Replace Agent Session History

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/activator.py:63

Finding

Unrestricted History Path and Configurable API Destination Enable Conditional File Exfiltration

Content

View full analysis

10 * 1024 * 1024: # 10MB limit print(f"Trunkate Alert: History file too large ({file_size} bytes). Skipping optimization.", file=sys.stderr) return with open(history_path, "r") as f: history = f.read() # 4. Filter Sensitive Content LOCALLY before external transmission filtered_history, protected_blocks = _filter_sensitive_content(history) # 5. Invoke Semantic Pruner with safe, filtered text optimized_filtered = optimize_prompt(filtered_history, budget=target_budget) ``` ```python # scripts/trunkate.py:9-22 def optimize_prompt(prompt: str, budget: Union[int, str] = 1000, model: str = "gpt-4o") -> str: """Optimizes a prompt using the private Trunkate AI API.""" api_url = os.environ.get("TRUNKATE_API_URL", API_URL).rstrip("/") api_key = os.environ.get("TRUNKATE_API_KEY") if not api_key: print("Error: TRUNKATE_API_KEY required.", file=sys.stderr) return prompt payload = {"text": prompt, "budget": budget, "model": model} headers = {"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"} try: response = requests.post(f"{api_url}/optimize", json=payload, headers=headers, timeout=10) ``` ### Technical Anal ...[truncated 2249 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence

Findings (36)

Tainted flow: 'headers' from os.environ.get (line 19, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/trunkate.py (reported line 22)May include surrounding context.

python

headers = {"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"}
    
    try:
        response = requests.post(f"{api_url}/optimize", json=payload, headers=headers, timeout=10)
        response.raise_for_status()
        return response.json().get("optimized_text", prompt)
    except Exception as e:

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CHANGELOG.md (reported line 30)May include surrounding context.

md

### Features

* Modify skill markdown ([5ccb7f7](https://github.com/Trunkate-AI/trunkate-ai-skills/commit/5ccb7f769a27adf2b14d5b0d924aaffc164d7236))

## [0.16.0](https://github.com/Trunkate-AI/trunkate-ai-skills/compare/openclaw-v0.15.0...openclaw-v0.16.0) (2026-03-02)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description centers on a context-compression/semantic-optimization skill that should process large text or conversation history through the Trunkate API, potentially with proactive hooks. The actual code does none of that: it neither sends text to an API nor transforms/summarizes context. Instead, it inspects OPENCLAW_LAST_ERROR_MESSAGE and emits stderr notices for specific failure categories. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The core behavior—calling the Trunkate API to optimize text—does align with the general description of semantic optimization. However, the description materially overstates the implemented functionality. The code only exposes a direct optimization helper and CLI wrapper for user-supplied text. It does not implement any automated hooks, trigger handling, proactive context management, file/log ingestion, conversation-history management, or error-driven invocation behavior described in the declared purpose. Because these claimed capabilities are central to the description rather than minor implementation details, this is a meaningful description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill encourages silent transmission of context to a private API while lacking a prominent user-facing privacy warning. Because the targeted data includes conversation history, logs, and large text blocks, this can expose proprietary code, secrets, personal data, or system instructions to an external service without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Automatic silent hooks that can prune history and externally process content create both privacy and integrity risks, and the documentation does not prominently warn users about either. Users may unknowingly lose important context or have sensitive data transmitted off-host because the design intentionally hides the action from them.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The described emergency history wipe can irreversibly remove context, but the documentation does not provide an explicit warning or consent model for that loss. In an agent setting, sudden context deletion can derail work, hide prior instructions, and destroy evidence needed for safe or correct operation.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

Copying and forwarding the full environment exposes all available environment variables to the child process, which may include API keys, tokens, workspace metadata, and other sensitive agent state. In a hook that runs automatically for a skill whose purpose is text optimization, this is especially risky because the broad data access is not tightly scoped to operational need.

Content

Scanner excerpt · hooks/openclaw/pre_request.py (reported line 22)May include surrounding context.

python

# Pass current environment (containing OpenClaw state) to the sub-process
        subprocess.run(
            [sys.executable, script_path], 
            env=os.environ.copy(), 
            check=True
        )
    except subprocess.CalledProcessError as e:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/activator.py (reported line 13)May include surrounding context.

python

def _filter_sensitive_content(text: str):
    """
    Extracts sensitive content (System Prompts, .env blocks, and [KEEP] tags) 
    LOCALLY and replaces them with UUID placeholders to prevent data exfiltration.
    """
    protected = {}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/activator.py (reported line 28)May include surrounding context.

python

def _filter_sensitive_content(text: str):
    """
    Extracts sensitive content (System Prompts, .env blocks, and [KEEP] tags) 
    LOCALLY and replaces them with UUID placeholders to prevent data exfiltration.
    """
    protected = {}

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/trunkate.py (reported line 16)May include surrounding context.

python

if not api_key:
        print("Error: TRUNKATE_API_KEY required.", file=sys.stderr)
        return prompt
    
    payload = {"text": prompt, "budget": budget, "model": model}
    headers = {"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"}

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/trunkate.py (reported line 27)May include surrounding context.

python

if not api_key:
        print("Error: TRUNKATE_API_KEY required.", file=sys.stderr)
        return prompt
    
    payload = {"text": prompt, "budget": budget, "model": model}
    headers = {"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"}

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares no explicit tool scope or permissions while its documented operation clearly involves shell execution, environment variable access, file reads, and outbound network access. In an agent ecosystem, this mismatch weakens user and platform understanding of what the skill can do, increasing the chance of over-privileged execution and unnoticed data egress.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest frames the skill as semantic optimization, but the documented behavior includes emergency history wipes, which are materially more destructive than summarization. This mismatch can cause users or orchestrators to permit the skill in contexts where data-loss operations were not expected, increasing the risk of irreversible loss of important context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill describes broad, automatic trigger conditions for context pruning without narrow activation criteria. In practice, vague triggers can cause the skill to activate on normal workflows, sending excess data externally or altering history unexpectedly, especially because the skill is positioned as invisible background infrastructure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

An always-on PreRequest hook that intercepts every outgoing LLM call is high risk because it creates a universal chokepoint for observing, modifying, compressing, or exfiltrating prompts. Even if intended for benign summarization, the lack of clear scoping means sensitive prompts, secrets, and system instructions could be processed or transmitted automatically.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation promotes invisible, always-on background operation without clear constraints, making unintended invocation more likely. In an agent environment, silent lifecycle hooks can repeatedly process sensitive context and change model inputs without user awareness, compounding both privacy and integrity risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instruction to avoid announcing truncation to the user conflicts with transparency and informed-consent expectations. Non-disclosure is especially risky here because the hidden action may alter prompt history or transmit content externally, preventing users from understanding changes in model behavior or privacy exposure.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Silent automated compression and logging can cause user-provided context to be transmitted to an external service or retained locally without the user's awareness. This creates privacy, compliance, and confidentiality risks, especially when logs or conversation history may contain secrets or regulated data.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

md

To comply with OpenClaw automated health/safety grades:

* **Safety Boundaries**: When performing shell execution (`exec`) to run local Python scripts (such as `activator.py` or `.openclaw` hooks), the skill is strictly restricted to semantic compression and logging. It contains safety boundaries to ensure it does not execute unknown payloads, access external network resources (other than api.trunkate.ai for optimization), or execute arbitrary code.
* **Permissions**: This skill **does not** require "Human-in-the-loop" approval because it does not perform destructive actions (like deleting tickets or pushing code). It operates purely on localized context and data streams.

---

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The safety text claims the skill operates purely on localized context and data streams, yet the document repeatedly states that content is sent to the Trunkate API. This is dangerous because it downplays external data transfer and may lead users to expose sensitive conversation history, logs, or project data under false privacy assumptions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The hook description states that conversation history is evaluated and compressed through the Trunkate AI API before requests are sent, but it does not clearly warn users that potentially sensitive session content may be transmitted to an external service. Because this skill is explicitly designed to act proactively and silently on context history, the omission undermines informed consent and can lead to unintended disclosure of secrets, proprietary code, or personal data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation notes that the hook updates session history via an action directive, but it does not clearly warn that this modification happens automatically as part of a PreRequest flow. Automatic rewriting of history can alter the agent's working context without user awareness, creating risks of loss of fidelity, hidden prompt manipulation surface, and unexpected changes to downstream model behavior.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 89% confidence

Finding

The hook executes a local Python subprocess during every PreRequest event, which expands the skill's runtime capabilities beyond simple text optimization and creates an execution path that may run attacker-modified local code. Because the invoked script path is relative and automatically triggered, this increases the risk of unintended code execution in the agent context.

Content

Scanner excerpt · hooks/openclaw/pre_request.py (reported line 20)May include surrounding context.

python

try:
        # Pass current environment (containing OpenClaw state) to the sub-process
        subprocess.run(
            [sys.executable, script_path], 
            env=os.environ.copy(), 
            check=True

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

A PreRequest hook that silently launches a local subprocess and forwards agent state is a sensitive capability, especially because it runs automatically before requests and is not obviously required for the stated purpose of semantic context reduction. In this context, the skill description's 'proactive' and 'silent context management' makes the behavior more dangerous because it can operate without user awareness on every request.

Content

No source excerpt is available for this finding.