ClawHub
Back to skill

Security audit

context-compressor

Security checks across malware telemetry and agentic risk

Overview

The skill has a coherent context-compression purpose, but it authorizes automatic file rewriting and pruning without clear confirmation, backups, or path limits.

Install only if you are comfortable with an agent rewriting and pruning project state files. Use it on a dedicated state file, keep version control or backups enabled, and avoid auto mode unless you have explicitly scoped which file it may modify.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly instructs writing compressed state back into the target file and pruning content, but it does not warn the user that this operation is destructive and may permanently remove information. In an agent setting, silent overwrite and pruning can cause data loss, corruption of project state, or unintended modification of user files if the target path is wrong or the compression logic is lossy.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The background auto mode is designed to monitor context and trigger automatic compression and file writes without manual intervention, yet the skill does not disclose this clearly as a risky behavior. Autonomous file modification increases the chance of unexpected writes, race conditions with user edits, and silent loss of information through pruning, especially because it is triggered by a threshold rather than a deliberate user action.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.