Security audit

Trunkate AI

Security checks across malware telemetry and agentic risk

Overview

This is a real context-compression skill, but enabling its hook can silently send agent history to a third-party API and replace the agent’s memory without clear per-use control.

Install only if you are comfortable with Trunkate processing conversation history and project context. Prefer manual CLI use over the always-on PreRequest hook, avoid sensitive or regulated sessions, scope the API key carefully, and review or disable automatic history replacement unless you have a trusted retention and privacy posture for the Trunkate API.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill declares no permissions while explicitly documenting capabilities that read local data, consume environment variables, execute shell commands, and send content to an external API. This is dangerous because users and host platforms cannot accurately assess or gate the real trust boundary, especially for an always-on hook that may process sensitive conversation history automatically.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose narrows the skill to context optimization near token limits, but the behavior expands to intercepting every request, reading history from local state, parsing errors, and transmitting content to a remote service. That mismatch is dangerous because it hides materially broader data handling and automation than a user would reasonably expect from the description.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The document claims system instructions are never sent to the API, while also recommending an always-on pre-request interceptor over outgoing LLM calls. This contradiction undermines trust in the boundary between protected and transmitted content, increasing the risk that sensitive prompt material is included accidentally.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The skill is presented as optimization, but it also advertises emergency wipes and resetting reasoning attention, which are destructive operations on context state. This matters because users may enable the skill expecting reversible summarization, not silent removal of history that can alter agent behavior or erase important context.

Description-Behavior Mismatch

Low

Confidence: 87% confidence
Finding: The skill is presented as optimization, but it also advertises emergency wipes and resetting reasoning attention, which are destructive operations on context state. This matters because users may enable the skill expecting reversible summarization, not silent removal of history that can alter agent behavior or erase important context.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill promotes silent automatic pruning and remote API use without a clear, prominent warning that user content and conversation history may leave the local environment. In a context-management skill, this is especially dangerous because the intercepted data is likely to include sensitive prompts, system instructions, secrets, file contents, or proprietary project information.

Missing User Warnings

High

Confidence: 99% confidence
Finding: An always-on PreRequest hook that runs before every LLM call materially expands the surveillance and exfiltration surface, yet the docs do not prominently warn that content may be sent externally as part of this automation. Because it is invisible and persistent, users may unknowingly expose all future prompts and context to a third-party API.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The instruction not to announce truncation to the user suppresses transparency around automatic context modification and possible external handling. This is dangerous because users lose the ability to make informed decisions about privacy, debugging, and whether important context was removed or shared.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The hook documentation states that request history may be automatically evaluated and compressed before every LLM request, but it does not clearly warn users that their prompt/history content can be modified silently. In a context-management skill, undisclosed alteration of conversational state is security-relevant because it can remove safety-relevant details, distort user intent, or cause the agent to act on an altered record without informed consent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The data-flow description says session history is updated through an `OPENCLAW_ACTION:SET_HISTORY` directive, which implies prior state can be overwritten, yet it does not warn users about loss or mutation of original context. Because this skill is explicitly designed to operate silently and proactively, the lack of disclosure makes the behavior more dangerous: critical instructions, evidence, or safety constraints could be replaced without the user realizing it.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The documentation says the PreRequest hook should trigger on a 'high-context command' when token usage exceeds a threshold, but it does not clearly define when optimization will run or what content will be sent. In this skill's context, that ambiguity is risky because the hook is proactive and silent, so users may unintentionally transmit sensitive prompts, code, logs, or file contents to an external API without realizing which actions activate it.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The setup guide instructs users to install a proactive PreRequest hook that performs automated context optimization via the Trunkate API, but it does not warn that conversation history and large text blocks may be sent over the network to a third-party service. Because the skill is specifically designed for silent, automated context management, this omission materially increases the chance of covert exfiltration of sensitive data such as source code, secrets in logs, or internal project context.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The spec explicitly sends the full prompt or conversation history to an external service for optimization, but it provides no consent flow, disclosure, data minimization guidance, or restrictions on sensitive content. In an agent context, prompt/history often contains secrets, credentials, internal documents, or personal data, so silent transmission to a third party creates a real confidentiality and privacy risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code reads the full conversation history from a local file and sends the filtered result to an external API via optimize_prompt without any explicit user consent, notice, or policy gate in this file. Although it attempts to redact some secrets locally, the redaction is pattern-based and incomplete, so sensitive conversational content, proprietary data, or missed secrets may still be transmitted off-host.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The function sends the full prompt text to an external service without any explicit user-facing notice, consent flow, or data-classification check. In this skill's context, prompts may contain conversation history, project state, logs, secrets, or proprietary code, so silent transmission to a third party creates a meaningful confidentiality risk.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Encouraging silent background handling of user/context data while relying on an external API reduces user awareness and weakens informed consent. In a skill whose primary function is to process conversational state, minimizing visibility materially increases privacy and integrity risks.

Ssd 3

High

Confidence: 97% confidence
Finding: Telling the agent not to disclose context pruning while also maintaining logs of optimization activity creates a hidden data-processing channel affecting user content. This is dangerous because it combines covert modification of context with secondary retention of summaries or metadata, undermining both transparency and privacy.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.