Skip to content
skillsafebeta
← Report library
Purpose / Other

Caveman Skill Security Audit

What the author says it does (original text)

>

Independent security check

Security risks found

Files checked
4
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

File contents are sent to Claude for processing

Source references: 3
What we found

The compression flow explicitly says it will “call Claude to compress.” Its targets include CLAUDE.md, todo, and preference files, which may contain internal instructions, private information, paths, links, or environment details.

Why this matters

When invoked, target-file contents may leave the local environment for processing by an external model service. The visible implementation does not establish the transmitted scope, server-side retention policy, or sensitive-data filtering.

When `/caveman-compress` processes a chosen file, the workflow sends its contents to Claude for compression. Its stated targets include CLAUDE.md, todos, and preference files, which may contain private information, internal instructions, paths, or links. The source does not identify the Claude service, retention policy, or any redaction before transmission. Users can ask the author to document the recipient and retention terms, and restrict use to reviewed, non-sensitive files.

caveman-compress/SKILL.md:12In the instructionsOpen original file
Compress natural language files (CLAUDE.md, todos, preferences) into caveman-speak to reduce input tokens. Compressed version overwrites original. Human-readable backup saved as `<filename>.original.md`, but NOT beside the source file — it lives in an out-of-tree data dir (`$XDG_DATA_HOME/caveman-compress/backups/<parent-dir-name>/`, or `%LOCALAPPDATA%\caveman-compress\backups\<parent-dir-name>\` on Windows) so skill auto-loaders don't re-ingest it as a live file.
Show 2 other places
caveman-compress/SKILL.md:26In the instructionsOpen original file
3. The CLI will:- detect file type (no tokens)- call Claude to compress- validate output (no tokens)- if errors: cherry-pick fix with Claude (targeted fixes only, no recompression)- retry up to 2 times- if still failing after 2 retries: report error to user, leave original file untouched
caveman-compress/SKILL.md:16In the instructionsOpen original file
`/caveman-compress <filepath>` or when user asks to compress a memory file.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

Lossy compression overwrites active memory or instruction files

Source references: 4
What we found

The Skill overwrites the source and permits merging supposedly redundant bullets and removing similar examples. Deciding that instructions are redundant requires semantic judgment and can discard exceptions, priorities, or subtle constraints.

Why this matters

A compressed CLAUDE.md, todo, or preference file may change later agent behavior or omit tasks. Although documentation promises a backup, it is stored elsewhere, and the visible implementation does not demonstrate that backup and validation reliably finish before replacement.

The feature overwrites an active file with model-compressed text and permits merging bullets or removing similar examples. Even though structure and code regions are preserved, semantic compression can merge instructions that look repetitive but carry distinct exceptions, priorities, or conditions, affecting later agent decisions. The risk is limited because only listed natural-language files are eligible and the original is backed up in a separate data directory. Users can verify the backup and ask for a diff preview plus explicit confirmation before replacement.

caveman-compress/SKILL.md:12In the instructionsOpen original file
Compress natural language files (CLAUDE.md, todos, preferences) into caveman-speak to reduce input tokens. Compressed version overwrites original. Human-readable backup saved as `<filename>.original.md`, but NOT beside the source file — it lives in an out-of-tree data dir (`$XDG_DATA_HOME/caveman-compress/backups/<parent-dir-name>/`, or `%LOCALAPPDATA%\caveman-compress\backups\<parent-dir-name>\` on Windows) so skill auto-loaders don't re-ingest it as a live file.
Show 3 other places
caveman-compress/SKILL.md:68In the instructionsOpen original file
- Drop "you should", "make sure to", "remember to" — just state the action- Merge redundant bullets that say the same thing differently- Keep one example where multiple examples show the same pattern
caveman-compress/SKILL.md:108In the instructionsOpen original file
- If unsure whether something is code or prose, leave it unchanged- Original file is backed up as FILE.original.md before overwriting — in the out-of-tree backup data dir (see Purpose), not beside the source file- Never compress FILE.original.md (skip it)
caveman-compress/SKILL.md:104In the instructionsOpen original file
- ONLY compress natural language files (.md, .txt, .typ, .typst, .tex, extensionless)- NEVER modify: .py, .js, .ts, .json, .yaml, .yml, .toml, .env, .lock, .css, .html, .xml, .sql, .sh- If file has mixed content (prose + code), compress ONLY the prose sections- If unsure whether something is code or prose, leave it unchanged- Original file is backed up as FILE.original.md before overwriting — in the out-of-tree backup data dir (see Purpose), not beside the source file- Never compress FILE.original.md (skip it)
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

Session-wide style override suppresses explanations around tool use

Source references: 3
What we found

Once enabled, the Skill persists across the session and directs the agent to provide no plan or progress narration around tool calls. Its auto-clarity rule preserves security and irreversible-action warnings, but ordinary file, account, or network operations may still lack context.

Why this matters

A user may have less visibility into what the agent is doing, why an operation is needed, or whether its scope has drifted. Extreme compression can also weaken qualifications in decisions not classified as security-sensitive.

Once enabled, the style persists across the session and suppresses ordinary plan or progress narration around tool calls. This can make it harder for users to understand the purpose and result of routine file, account, or network operations in time. The restriction is not absolute: clarification, ambiguity, security warnings, and irreversible confirmations permit or require clear prose. Users can ask the author to exempt all file, account, permission, and network actions, or disable the mode before sensitive work.

SKILL.md:13In the instructionsOpen original file
Default style for this whole session, every response, until user say "stop caveman" or "normal mode". Keep terse on long sessions no filler drift.Default: **full**. Switch: `/caveman lite|full|ultra|wenyan-lite|wenyan-full|wenyan-ultra|off`.
Show 2 other places
SKILL.md:27In the instructionsOpen original file
Tool calls: fire direct. No preamble, plan, or progress note before or between calls. After result: next call direct or final answer never announce next call. Text before call only to clarify, warn security/irreversible, or resolve ambiguity.
SKILL.md:70In the instructionsOpen original file
Drop caveman when:- Security warnings- Irreversible action confirmations- Multi-step sequences where fragment order or omitted conjunctions risk misread- Compression itself creates technical ambiguity (e.g., `"migrate table drop column backup first"` order unclear without articles/conjunctions)- User asks to clarify or repeats questionResume caveman after clear part done.
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

5 instruction sections

The main Skill changes the model's response style and keeps that style active for the entire session until the user explicitly disables it.

View source
SKILL.md:9In the instructionsOpen original file
Respond terse like smart caveman. All technical substance stay. Only fluff die.
SKILL.md:13In the instructionsOpen original file
Default style for this whole session, every response, until user say "stop caveman" or "normal mode". Keep terse on long sessions no filler drift.

The compression sub-Skill accepts a natural-language file path, calls Claude to generate compressed content, and says it overwrites the source after success while placing a backup in a user data directory.

View source
caveman-compress/SKILL.md:12In the instructionsOpen original file
Compress natural language files (CLAUDE.md, todos, preferences) into caveman-speak to reduce input tokens. Compressed version overwrites original. Human-readable backup saved as `<filename>.original.md`, but NOT beside the source file — it lives in an out-of-tree data dir (`$XDG_DATA_HOME/caveman-compress/backups/<parent-dir-name>/`, or `%LOCALAPPDATA%\caveman-compress\backups\<parent-dir-name>\` on Windows) so skill auto-loaders don't re-ingest it as a live file.
caveman-compress/SKILL.md:24In the instructionsOpen original file
python3 -m scripts <absolute_filepath>
caveman-compress/SKILL.md:26In the instructionsOpen original file
3. The CLI will:- detect file type (no tokens)- call Claude to compress- validate output (no tokens)- if errors: cherry-pick fix with Claude (targeted fixes only, no recompression)- retry up to 2 times- if still failing after 2 retries: report error to user, leave original file untouched

The provided Python entry point only delegates execution to `.cli.main`; the visible code does not show how data submission, validation, backup, or replacement is implemented, so those safeguards remain documentation claims.

View source
caveman-compress/scripts/__main__.py:1In the codeOpen original file
from .cli import mainmain()

The README's description of ultra mode conflicts with the live Skill instructions: the README advertises abbreviations and arrows, while the Skill explicitly forbids both. This makes the resulting behavior harder for a user to predict.

View source
README.md:19In the instructionsOpen original file
| `full` | Default. Drop articles, fragments OK, short synonyms. || `ultra` | Bare fragments. Abbreviations (DB, auth, fn). Arrows for causality. || `wenyan-lite` | Classical Chinese register, light compression. |
SKILL.md:46In the instructionsOpen original file
| **full** | Drop articles, fragments OK, short synonyms. Classic caveman. No tool-call narration, no decorative tables/emoji, no long raw error-log dumps unless asked. Standard acronyms OK; no invented abbreviations || **ultra** | Strip conjunctions when cause-then-effect stay unambiguous. One word when one word enough. State each fact once. NO prose abbreviations (cfg/impl/req/res/fn/auth), NO arrows (X → Y) measured zero token saving under tokenizer, cost decode clarity. Code symbols, function names, API names, error strings: never touch || **wenyan-lite** | Semi-classical. Drop filler/hedging but keep grammar structure, classical register |
Start here · InstructionsSKILL.md
caveman
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 2
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records4 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • caveman-compress/scripts/__main__.pyFull text included
  • caveman-compress/SKILL.mdFull text included
  • README.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • README.mdSupporting file
  • SKILL.mdInstructions
  • caveman-compress/SKILL.mdSupporting file
  • caveman-compress/scripts/__main__.pyScript

Operations mentioned in code and instructions

Install extra software packages
caveman-compress/SKILL.md:51In the instructionsOpen original file
- File paths (`/src/components/...`, `./config.yaml`)- Commands (`npm install`, `git commit`, `docker build`)- Technical terms (library names, API names, protocols, algorithms)
Read keys or account settings
caveman-compress/SKILL.md:105In the instructionsOpen original file
- ONLY compress natural language files (.md, .txt, .typ, .typst, .tex, extensionless)- NEVER modify: .py, .js, .ts, .json, .yaml, .yml, .toml, .env, .lock, .css, .html, .xml, .sql, .sh- If file has mixed content (prose + code), compress ONLY the prose sections
Lines read
257
File checksum (to compare versions)
dd7f48c5afa9fc88ca520ddba9064ee70f4659cc367e8ac3605ce11fc09e036f