Context Compactor (Zero Dep)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:18 AM UTC
• Version: 1.1.3

Overview

The skill is a local session-memory compactor, but it stores and reinjects conversation-derived information with broad triggers and weak safeguards around sensitive technical data.

Review before installing if your conversations may contain credentials, private infrastructure details, customer data, or sensitive project context. Use it only when you explicitly want local cross-session memory, inspect generated compacts, and avoid relying on its current redaction checks as a complete secret scanner.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: references/compaction_prompt.md:10

Finding

Untrusted Conversation Content Can Poison Persistent Session Compacts

Content

View full analysis

4. Skip debugging noise unless it led to a lesson 5. Be specific about decisions but vague about locations 6. Be specific: "chose SQLite for prompt storage" not "chose a database" Conversation: --- {conversation_text} --- ``` ``` The resulting compact is intended to be reinjected into future sessions: ```markdown ### When to Inject Compact - New session startup — check for recent compact - User asks "what were we working on" - Context search returns nothing but a compact exists ``` ### Technical Analysis The LLM prompt directly interpolates the complete conversation into `{conversation_text}`. The template does not explicitly state that text inside this field is untrusted data and that any instructions contained in it must not be followed. The `---` Markdown delimiters provide visual separation but are not a security boundary. A malicious conversation participant can include instructions that attempt to override the compaction rules, insert false facts, preserve behavioral directives, or suppress relevant information. This becomes a persistent risk because the Skill ...[truncated 1574 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/compact_session.py:42

Finding

Blacklist-Based Secret Filtering Fails to Detect Common Credential Formats

Content

View full analysis

str: """Remove sensitive data, redact paths and URLs, strip control characters.""" # Redact secrets first text = SENSITIVE.sub("[REDACTED]", text) # Redact internal IPs text = REDACT_INTERNAL.sub("", text) # Redact URLs text = REDACT_URL.sub("", text) # Redact file paths (2+ segments) text = REDACT_PATH.sub(lambda m: m.group(0).replace(m.group(1), ""), text) # Strip control chars text = re.sub(r"[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]", "", text) return text.strip() ``` ```python def cmd_write_raw(content: str): """Write pre-formatted compact content through security checks only.""" # Verify no sensitive data in the content if SENSITIVE.search(content): print("SECURITY: Content contains sensitive patterns. Redact and retry.") sys.exit(1) if REDACT_URL.search(content): print("SECURITY: Content contains URLs. Replace with and retry.") sys.exit(1) if REDACT_INTERNAL.search(content): print("SECURITY: Content contains internal IPs. Replace with and retry.") sys.exit(1) if REDACT_PATH.search(content): print("SECURITY: Content contains file paths. Replace with and retry.") sys.exit(1) filepath = save_compact(content) print(f"Compact saved: {filepath}") ``` ## ...[truncated 2186 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/compact_session.py:27

Finding

Filesystem Containment Uses Bypassable String-Prefix Validation

Content

View full analysis

None: """Reject any path outside workspace/memory/compacts/.""" try: resolved = path.resolve() workspace_resolved = WORKSPACE.resolve() if not str(resolved).startswith(str(workspace_resolved)): raise ValueError(f"Path outside workspace: {resolved}") if not str(resolved).startswith(str(COMPACTS_DIR.resolve())): if resolved != WORKSPACE / "SESSION-STATE.md": raise ValueError(f"Write outside compacts dir: {resolved}") except (OSError, ValueError) as e: print(f"SECURITY: {e}") sys.exit(1) ``` The validator is used before reading caller-selected files: ```python def cmd_from_file(filepath: str): """Extract compact from a file. Restricted to workspace only.""" path = Path(filepath) if not path.exists(): print(f"File not found: {filepath}") sys.exit(1) # Security: only read files inside workspace assert_safe_path(path) text = path.read_text(encoding="utf-8") cmd_extract(text) ``` ### Technical Analysis The validator determines filesystem ancestry using string-prefix comparisons: ```python str(resolved).startswith(str(COMPACTS_DIR.resolve())) ``` A string prefix does not enforce a path-component boundary. If the authorized directory is: ```text /memory/compacts ``` then a sibling path such as: ```text /memory/compacts-backup/conversation.md ``` also begins with the same string. It can therefore pass the compact-directory check even though it is not inside `memory/compacts/`. Calling `Path.resolve()` protects against straightforward `..` ...[truncated 2077 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code largely aligns in intent with the description: it parses conversation text, extracts decisions/facts/pending items/blockers, redacts sensitive content, writes compact summaries to disk, and can list/read recent compacts. Those are consistent supporting behaviors. However, there is a material mismatch because the primary extraction pathway appears nonfunctional: main() invokes cmd_extract(text), but no such function is defined. The available function is cmd_write(text), which seems intended for extraction-and-save, but it is never called. As a result, the core advertised behavior of summarizing conversations is not actually implemented in the supplied executable path. Additionally, the declared description says summaries are 'injected into new sessions,' but this script only exposes CLI commands to list or print compacts; no session injection/integration logic is present. These are substantial discrepancies in core behavior, not minor implementation details.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

- `memory/compacts/` — for listing/reading past compacts

The agent MUST NOT read from:
- `/etc/passwd`, `/etc/shadow`, or any system credential file
- `~/.ssh/`, `~/.aws/`, `~/.config/openclaw/` or similar
- Any file outside the workspace unless explicitly asked by the user

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

- `memory/compacts/` — for listing/reading past compacts

The agent MUST NOT read from:
- `/etc/passwd`, `/etc/shadow`, or any system credential file
- `~/.ssh/`, `~/.aws/`, `~/.config/openclaw/` or similar
- Any file outside the workspace unless explicitly asked by the user

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises file read/write and environment-dependent behavior but declares no explicit tool scope or allowed-tools boundary. In agent ecosystems, missing capability declarations can cause over-broad tool access or unclear enforcement, increasing the chance the agent performs unintended file operations while processing sensitive conversation data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Broad activation triggers like 'summarize this conversation' or 'start fresh but remember' can cause the skill to persist conversation content in situations where the user did not clearly consent to durable storage. Because this skill writes retained summaries to disk, ambiguous triggering materially raises privacy and data-retention risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill is explicitly designed to persist session-derived data to disk for later reuse. That persistence is the core feature, but it is still a security-relevant behavior because retained summaries may contain confidential project or user context and survive beyond the immediate conversation.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

## Security

### Write Restrictions (Hard Rules)
The agent may ONLY write to these locations:
- `memory/compacts/` — compact files only
- `SESSION-STATE.md` — via smart-memory skill (not this skill)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill's example compact and extraction rules instruct preservation of URLs, paths, hostnames, database names, and similar technical details despite an earlier promise to redact them. This contradiction normalizes storing sensitive operational context in retained summaries, creating a realistic risk of secret-adjacent data leakage and long-term persistence of infrastructure metadata.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The additional trigger list includes everyday phrases like 'summarize' and 'fresh start', which can occur in normal conversation without the user intending persistent storage. In a memory/persistence skill, vague triggers increase the chance of unexpected retention of sensitive context and therefore are security-relevant rather than merely UX issues.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The documented workflow writes compacted session content to disk via a CLI pipeline. Even with claimed redaction checks, this still creates durable storage of conversation-derived information, so the risk is unexpected persistence and later disclosure rather than code execution.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

How to Compact

The agent drafts the compact content, then saves it via:

text

echo "compact content" | python3 scripts/compact_session.py --write

The --write flag enforces all security checks programmatically: redaction of paths/URLs/IPs/secrets, path containment within workspace, and file naming. The agent NEVER writes directly to disk.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The extraction guidance tells the agent to preserve broad facts, technical details, and user preferences in reusable summaries. Even if obvious secrets are removed, this creates semantic retention of sensitive context that can later be exposed to other prompts, sessions, or operators, especially because the purpose of the skill is cross-session reuse.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring and usage examples say the tool extracts digests and saves them to disk, but the implemented --extract and --from-file paths invoke cmd_extract at L299 and L383, which is not defined anywhere in the file. In contrast, the actual save-to-disk behavior exists under cmd_write, so the documented primary extraction behavior contradicts the code as written.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code's stated behavior includes extracting digests from conversation text and saving them to disk, which affects user data persistence. Although the file has docstrings and status prints, there is no explicit warning or confirmation that potentially sensitive conversation content will be stored under the workspace, so users may not realize their session data is being retained.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The --from-file path reads arbitrary workspace conversation files and routes their contents into compact extraction and saving, creating a new stored artifact. The function includes path restriction comments but no user-facing disclosure that the source file's contents will be transformed and retained on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The top-level description emphasizes convenience but does not clearly warn that compacts are retained on disk and that retention management includes auto-deletion. For a skill that stores conversation-derived data, inadequate upfront disclosure undermines informed consent and can lead to unintended persistence of sensitive business context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The cmd_write docstring says it writes through the full security pipeline including sanitization, and the code even creates sanitized_text at L261. However, the saved content is generated from extract_from_text output and sanitized_text is never used, so the function's stated behavior does not match what it actually persists.

Content

No source excerpt is available for this finding.