compact-prep
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to manage a local state directory. It ensures the directory exists and performs automated cleanup of session files older than 7 days using the
findcommand. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates prompt injection via a post-compression recovery mechanism to maintain state consistency.
- Ingestion points: The agent is prompted to read generated
.mdfiles in~/.claude/compact-state/, and the Python hook script injects text into the context duringSessionStartandUserPromptSubmitevents. - Boundary markers: The hook uses explicit XML-style tags (
<compact-recovery>,<compact-recovery-reminder>,<context-usage-warning>) to demarcate the injected instructions. - Capability inventory: The skill possesses
Read,Write, andBashcapabilities inSKILL.mdto manage state files and perform directory maintenance. The hook script has file system access for status markers. - Sanitization: The hook script wraps its output in JSON via
json.dumps, ensuring structural integrity when communicating with the host platform. - [SAFE]: The skill's operations are confined to the local filesystem within a specific application directory (
~/.claude/compact-state). It does not perform network operations, exfiltrate data, or attempt to acquire elevated privileges.
Audit Metadata