JunHo Kim
25256ec417
Extracted and cleaned up from a prior WSL/Windows agent-memory setup. Contains only project-agnostic content: - Claude_Memory/: feedback rules, user profile, reusable reference docs, session scratch space (claude_info/, claude_log/), mirrored skill defs - caveman/: ultra-compressed communication mode skill + subcommands - html-slide-deck/: self-contained HTML slide deck builder skill Project-specific knowledge (previously mixed in) was moved out to each project's own repository as part of this cleanup.
1.5 KiB
Executable File
Security
Snyk High Risk Rating
caveman-compress receives a Snyk High Risk rating due to static analysis heuristics. This document explains what the skill does and does not do.
What triggers the rating
-
subprocess usage: The skill calls the
claudeCLI viasubprocess.run()as a fallback whenANTHROPIC_API_KEYis not set. The subprocess call uses a fixed argument list — no shell interpolation occurs. User file content is passed via stdin, not as a shell argument. -
File read/write: The skill reads the file the user explicitly points it at, compresses it, and writes the result back to the same path. A
.original.mdbackup is saved alongside it. No files outside the user-specified path are read or written.
What the skill does NOT do
- Does not execute user file content as code
- Does not make network requests except to Anthropic's API (via SDK or CLI)
- Does not access files outside the path the user provides
- Does not use shell=True or string interpolation in subprocess calls
- Does not collect or transmit any data beyond the file being compressed
Auth behavior
If ANTHROPIC_API_KEY is set, the skill uses the Anthropic Python SDK directly (no subprocess). If not set, it falls back to the claude CLI, which uses the user's existing Claude desktop authentication.
File size limit
Files larger than 500KB are rejected before any API call is made.
Reporting a vulnerability
If you believe you've found a genuine security issue, please open a GitHub issue with the label security.