Security audit

Dragon Session Compactor

Security checks for vulnerabilities and agentic risk

Overview

This is a local session-compaction skill whose sensitive behavior is disclosed and aligned with its purpose, but users should be careful because it persists and rewrites conversation history.

Install only if you are comfortable with local conversation history being summarized and persisted. Avoid using it on sessions containing secrets, credentials, regulated data, or private personal details unless you have reviewed the resulting .clawsession.json; enable heartbeat or cron checks only when you intentionally want automatic compaction.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger phrases are broad enough to match normal conversation such as mentioning 'compact' or '上下文满了', which can cause the skill to run without clear, intentional user consent. Because this skill rewrites retained conversation state, accidental invocation can silently alter context and reduce integrity of future agent behavior.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The description advertises automatic compaction but does not warn that original conversational detail may be removed or replaced with a lossy summary. Users and operators may therefore enable it without understanding that important security, audit, or task context can be discarded or distorted.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill stores full session data, including messages and tool-use input, in a local session file and also maintains compaction logs. This creates a data retention surface where sensitive prompts, secrets, file paths, and tool parameters may persist longer than intended and become accessible to other local processes or users.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The summarization logic explicitly instructs collection and restatement of prior user messages, AI responses, and tool-use details, which can re-expose sensitive information in a new artifact. Summaries often travel farther than raw transcripts, so compressing secrets into a concise block can actually increase the chance of later leakage or unintended reuse.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The example summary format encourages preserving identifiable user requests, file names, operation history, and even recent message text inside a reusable summary block. In context, this makes the risk more concrete because the summary is designed to be fed back into future sessions, propagating sensitive context beyond its original need.

Static analysis

No suspicious patterns detected.