Caveman Compress Skill 安全审计

429            pass  # anthropic not installed, fall back to CLI430    # Fallback: use claude CLI (handles desktop auth).431    # Resolve binary via shutil.which so Windows .cmd/.bat shims (e.g.432    # %APPDATA%\npm\claude.CMD) work without shell=True. On POSIX,433    # shutil.which returns the same absolute path as the implicit lookup,434    # so this is a no-op there. Falls back to bare "claude" if not found435    # on PATH so subprocess raises a clear FileNotFoundError.436    claude_bin = shutil.which("claude") or "claude"437    try:438        result = subprocess.run(439            [440                claude_bin,441                "--print",442                "--setting-sources",443                "",444                "--strict-mcp-config",445            ],446            input=prompt,447            text=True,

402403    Prefers the Anthropic SDK when ANTHROPIC_API_KEY is set; otherwise falls404    back to the ``claude --print`` CLI (which handles desktop auth).405

445            ],446            input=prompt,447            text=True,448            capture_output=True,449            check=True,450            encoding="utf-8",451            errors="replace",452            timeout=CLAUDE_CALL_TIMEOUT_SECONDS,453        )

600601    # Refuse files that look like they contain secrets or PII. Compressing ships602    # the raw bytes to the Anthropic API — a third-party boundary — so we fail603    # loudly rather than silently exfiltrate credentials or keys. Override is604    # intentional: the user must rename the file if the heuristic is wrong.605    if is_sensitive_path(filepath):606        raise ValueError(607            f"Refusing to compress {filepath}: filename looks sensitive "608            "(credentials, keys, secrets, or known private paths). "609            "Compression sends file contents to the Anthropic API. "610            "Rename the file if this is a false positive."611        )

502503ORIGINAL (reference only):504{original}505506COMPRESSED (fix this):507{compressed}508

729730        print("Fixing with Claude...")731        fixed = call_claude(732            build_fix_prompt(original_text, compressed, result.errors)733        )734

412    """413    api_key = os.environ.get("ANTHROPIC_API_KEY")414    if api_key:415        try:416            import anthropic417418            client = anthropic.Anthropic(api_key=api_key, timeout=CLAUDE_CALL_TIMEOUT_SECONDS)419            msg = client.messages.create(420                model=os.environ.get("CAVEMAN_MODEL", "claude-sonnet-4-5"),421                max_tokens=8192,422                messages=[{"role": "user", "content": prompt}],423            )424            # Tool-heavy models can put a tool_use or thinking block first; take

653654    # Step 1: Compress (body only, frontmatter excluded)655    print("Compressing with Claude...")656    masked_body, code_blocks = mask_code_blocks(body)657    masked_compressed = call_claude(build_compress_prompt(masked_body))658    try:

690691    # Save original as backup, then verify the backup readback before692    # touching the input file. If the filesystem dropped bytes (encoding,693    # antivirus, disk full), unlink the bad backup and abort instead of694    # leaving the user with a corrupt backup + compressed primary.695    backup_dir.mkdir(parents=True, exist_ok=True)696    write_bytes_atomic(backup_path, original_raw)697    if backup_path.read_bytes() != original_raw:698        print(f"❌ Backup write verification failed: {backup_path}")

1415- Does not execute user file content as code16- Does not make network requests except to Anthropic's API (via SDK or CLI)17- Does not access files outside the path the user provides18- Does not use shell=True or string interpolation in subprocess calls19- Does not collect or transmit any data beyond the file being compressed20

624625    original_text, newline, original_raw = read_source(filepath)626    # Store backup outside the source directory so skill auto-loaders don't627    # re-ingest the `.original.md` copy as a live file. Mirror the source's628    # parent-dir name + stem under a platform-aware base to reduce collisions.629    backup_dir = backup_dir_for(filepath)630    backup_path = backup_dir / (filepath.stem + ".original.md")631

381382def validate(original_path: Path, compressed_path: Path) -> ValidationResult:383    result = ValidationResult()384385    orig = read_file(original_path)386    comp = read_file(compressed_path)387388    validate_headings(orig, comp, result)389    validate_code_blocks(orig, comp, result)390    validate_urls(orig, comp, result)391    validate_paths(orig, comp, result)392    validate_bullets(orig, comp, result)393    validate_inline_codes(orig, comp, result)394395    return result396

713714        if result.is_valid:715            print("Validation passed")716            _write_target(filepath, compressed, backup_path, newline)717            staging_path.unlink(missing_ok=True)718            return True719

161162Caveman reduced counted tokens by about 46% on five listed fixtures. Validators163confirmed headings, code blocks, URLs, and file paths. They did not establish164general semantic or task-quality equivalence.165

463464def build_compress_prompt(original: str) -> str:465    return f"""466Compress this markdown into caveman format.467468STRICT RULES:469- Do NOT modify anything inside ``` code blocks470- Do NOT modify anything inside a 4-space-indented code block either — those are code too, and they are validated471- Do NOT modify anything inside inline backticks472- Preserve ALL URLs exactly473- Preserve ALL headings exactly474- Preserve file paths and commands475- Return ONLY the compressed markdown body — do NOT wrap the entire output in a ```markdown fence or any other fence. Inner code blocks from the original stay as-is; do not add a new outer fence around the whole file.476477Only compress natural language.478479TEXT:480{original}481"""