compact-prep

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to manage a local state directory. It ensures the directory exists and performs automated cleanup of session files older than 7 days using the find command.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates prompt injection via a post-compression recovery mechanism to maintain state consistency.
  • Ingestion points: The agent is prompted to read generated .md files in ~/.claude/compact-state/, and the Python hook script injects text into the context during SessionStart and UserPromptSubmit events.
  • Boundary markers: The hook uses explicit XML-style tags (<compact-recovery>, <compact-recovery-reminder>, <context-usage-warning>) to demarcate the injected instructions.
  • Capability inventory: The skill possesses Read, Write, and Bash capabilities in SKILL.md to manage state files and perform directory maintenance. The hook script has file system access for status markers.
  • Sanitization: The hook script wraps its output in JSON via json.dumps, ensuring structural integrity when communicating with the host platform.
  • [SAFE]: The skill's operations are confined to the local filesystem within a specific application directory (~/.claude/compact-state). It does not perform network operations, exfiltrate data, or attempt to acquire elevated privileges.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 01:23 AM
Security Audit — agent-trust-hub — compact-prep