claude-slim 2.13.1 → 2.14.1

package/README.md

@@ -139,6 +139,14 @@ claude plugin install claude-slim
 
 Then just type `/claude-slim` in any session.
 
+Or install it through the [skills.sh](https://skills.sh) directory, which can also place
+the skill into Codex, Cursor, and OpenCode. What claude-slim *analyzes* is unchanged:
+`~/.claude/` and `~/.codex/`.
+
+```bash
+npx skills add iops-leo/claude-slim
+```
+
 ---
 
 ## Usage

package/dist/scanner/index.js

@@ -20,6 +20,7 @@ import { scanPluginSurfaces } from './plugin-surfaces.js';
 import { computePluginBreakdown } from './plugin-breakdown.js';
 import { computePluginCosts } from './plugin-cost.js';
 import { scanUserSurfaces } from './user-surfaces.js';
+import { sanitizeScanResult } from './untrusted.js';
 const DEFAULT_LOOKBACK_DAYS = 60;
 export async function scan(opts = {}) {
     const lookbackDays = opts.lookbackDays ?? DEFAULT_LOOKBACK_DAYS;
@@ -149,7 +150,10 @@ export async function scan(opts = {}) {
         pluginSkillListingTokens.set(c.pluginName, (pluginSkillListingTokens.get(c.pluginName) ?? 0) + c.skillTokens);
     }
     const recoverableStartupTokens = sumRecoverableStartupTokens(issues, [...localSkills, ...pluginSkills], currentProjectSlug, pluginSkillListingTokens);
-    return {
+    // Labels below are authored by whoever wrote each skill, plugin, or memory
+    // file, and they reach the agent's context through the report. Flatten them
+    // at this one exit rather than at each site that reads a name off disk.
+    return sanitizeScanResult({
         localSkills,
         pluginSkills,
         plugins,
@@ -171,7 +175,7 @@ export async function scan(opts = {}) {
         allProjectsMemoryTokens,
         recoverableStartupTokens,
         disabledPluginSkillTokens,
-    };
+    });
 }
 async function pathExists(p) {
     try {

package/dist/scanner/untrusted.d.ts

@@ -0,0 +1,30 @@
+import type { ScanResult } from '../types.js';
+/**
+ * Names read off disk are written by whoever authored the skill, plugin, or
+ * memory file — not by the user running the scan. They flow through the report
+ * into the agent's context, which makes them an indirect prompt injection
+ * surface: a skill directory or frontmatter `name:` can carry instructions
+ * aimed at the model rather than a label aimed at a human.
+ *
+ * Snyk's audit of this skill (W011, medium 0.30) is about exactly this path.
+ * The scan never emits file *bodies* — descriptions are measured for token cost
+ * and then discarded — so what this module covers is the whole exposed surface,
+ * not a sample of it.
+ */
+/** Longest label we render. Real names are far shorter; payloads are not. */
+export declare const MAX_NAME_LENGTH = 120;
+/**
+ * Collapse an untrusted label to a single bounded, printable line.
+ *
+ * Deliberately not an escape or an encoding: the value is a display label, and
+ * a reversible transform would relocate a payload rather than remove it.
+ */
+export declare function sanitizeUntrusted(value: string, max?: number): string;
+/**
+ * Return a copy of the scan with every outsider-authored label flattened.
+ *
+ * Applied once at the scanner's exit rather than at each of the dozen sites
+ * that read a name off disk: one chokepoint cannot be forgotten by whoever adds
+ * the next detector.
+ */
+export declare function sanitizeScanResult(result: ScanResult): ScanResult;

package/dist/scanner/untrusted.js

@@ -0,0 +1,101 @@
+/**
+ * Names read off disk are written by whoever authored the skill, plugin, or
+ * memory file — not by the user running the scan. They flow through the report
+ * into the agent's context, which makes them an indirect prompt injection
+ * surface: a skill directory or frontmatter `name:` can carry instructions
+ * aimed at the model rather than a label aimed at a human.
+ *
+ * Snyk's audit of this skill (W011, medium 0.30) is about exactly this path.
+ * The scan never emits file *bodies* — descriptions are measured for token cost
+ * and then discarded — so what this module covers is the whole exposed surface,
+ * not a sample of it.
+ */
+/** Longest label we render. Real names are far shorter; payloads are not. */
+export const MAX_NAME_LENGTH = 120;
+/** C0/C1 controls, including the newlines that would forge new report rows. */
+const CONTROL_CHARS = /[\u0000-\u001F\u007F-\u009F]/g;
+/**
+ * Zero-width and bidi-override characters: invisible to the human reading the
+ * report, fully visible to the model reading the same string.
+ */
+const INVISIBLE = /[\u200B-\u200F\u202A-\u202E\u2060-\u2064\u2066-\u2069\uFEFF]/g;
+/**
+ * Collapse an untrusted label to a single bounded, printable line.
+ *
+ * Deliberately not an escape or an encoding: the value is a display label, and
+ * a reversible transform would relocate a payload rather than remove it.
+ */
+export function sanitizeUntrusted(value, max = MAX_NAME_LENGTH) {
+    const flattened = value
+        .replace(CONTROL_CHARS, ' ')
+        .replace(INVISIBLE, '')
+        .replace(/\s+/g, ' ')
+        .trim();
+    if (flattened.length <= max)
+        return flattened;
+    return `${flattened.slice(0, max)}…`;
+}
+/**
+ * Paths are shown to the user and used to locate files for cleanup, so they are
+ * flattened but never truncated — a shortened path would be a wrong path.
+ */
+function sanitizePath(value) {
+    return value.replace(CONTROL_CHARS, ' ').replace(INVISIBLE, '').trim();
+}
+/**
+ * Return a copy of the scan with every outsider-authored label flattened.
+ *
+ * Applied once at the scanner's exit rather than at each of the dozen sites
+ * that read a name off disk: one chokepoint cannot be forgotten by whoever adds
+ * the next detector.
+ */
+export function sanitizeScanResult(result) {
+    const skill = (s) => ({
+        ...s,
+        name: sanitizeUntrusted(s.name),
+        path: sanitizePath(s.path),
+    });
+    return {
+        ...result,
+        localSkills: result.localSkills.map(skill),
+        pluginSkills: result.pluginSkills.map(skill),
+        plugins: result.plugins.map((p) => ({
+            ...p,
+            name: sanitizeUntrusted(p.name),
+            skills: p.skills.map((s) => sanitizeUntrusted(s)),
+        })),
+        brokenSymlinks: result.brokenSymlinks.map((b) => ({
+            ...b,
+            name: sanitizeUntrusted(b.name),
+            path: sanitizePath(b.path),
+            target: sanitizeUntrusted(b.target),
+        })),
+        memoryFiles: result.memoryFiles.map((m) => ({
+            ...m,
+            project: sanitizeUntrusted(m.project),
+            name: sanitizeUntrusted(m.name),
+            path: sanitizePath(m.path),
+        })),
+        claudeMdSections: result.claudeMdSections.map((s) => ({
+            ...s,
+            name: sanitizeUntrusted(s.name),
+        })),
+        mcpServerNames: result.mcpServerNames.map((n) => sanitizeUntrusted(n)),
+        issues: result.issues.map((i) => ({
+            ...i,
+            name: sanitizeUntrusted(i.name),
+            path: sanitizePath(i.path),
+            ...(i.detail === undefined ? {} : { detail: sanitizeUntrusted(i.detail) }),
+            ...(i.marketplace === undefined
+                ? {}
+                : { marketplace: sanitizeUntrusted(i.marketplace) }),
+        })),
+        pluginBreakdown: result.pluginBreakdown.map((p) => ({
+            ...p,
+            name: sanitizeUntrusted(p.name),
+            marketplace: sanitizeUntrusted(p.marketplace),
+        })),
+        userAgents: result.userAgents.map((a) => ({ ...a, name: sanitizeUntrusted(a.name) })),
+        userCommands: result.userCommands.map((c) => ({ ...c, name: sanitizeUntrusted(c.name) })),
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-slim",
-  "version": "2.13.1",
+  "version": "2.14.1",
   "description": "Audit and shrink your Claude Code startup context. Measures what every skill, plugin, agent, command, and memory file costs in the system prompt, then reversibly disables the dead weight. Non-destructive scan, tiered proposals, one-command restore — no proxy, no compression.",
   "type": "module",
   "bin": {

package/skills/claude-slim/SKILL.md

@@ -18,16 +18,38 @@ Analyze the user's Claude Code environment for token waste and perform non-destr
 
 ---
 
+## Running the CLI
+
+Every command block below opens with a `claude_slim()` resolver. It is repeated in full each
+time on purpose: each Bash invocation is a fresh shell, so a function defined in one
+block does not survive into the next. It resolves in three tiers — the plugin's own
+`dist/cli.js` when `CLAUDE_PLUGIN_ROOT` is set, then a `claude-slim` on `PATH`, then
+`npx`. That last tier is what makes the skill work when it was installed by
+`npx skills add` rather than `claude plugin install`, where no plugin root exists.
+
+Do not shorten the name. A two-letter `cs` collides with claude-squad's binary, and a
+shell function is invisible to `timeout`, `env`, and `xargs` — a wrapped call would
+silently run that other program instead. Call `claude_slim` directly, never through a
+wrapper.
+
+---
+
 ## Phase 0 — Version gate (run before every scan)
 
 An outdated claude-slim does not merely lack features — it reports **wrong numbers**. Versions before 2.8.0 summed memory across every project on disk and inflated the startup estimate roughly 8×. Presenting those figures as fact is worse than not running at all, so check first:
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" check-update --json
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim check-update --json
 ```
 
 The check is cached for 24h and fails open — if it errors, times out, or returns `"latest": null`, **proceed silently**. Never block the user because a version lookup failed.
 
+The response carries `installMethod`. When it is `"npx"` the gate is structurally
+inert — the CLI was just fetched at the tag it is being compared against, so `outdated`
+can never be true. Note that the version was resolved at run time and move on; do not
+present the gate as a safeguard it is not.
+
 If `"outdated": true`, stop and tell the user before scanning:
 
 > 설치된 claude-slim이 {installed}이고 최신은 {latest}입니다.
@@ -39,7 +61,7 @@ If `"outdated": true`, stop and tell the user before scanning:
 
 Then honour their answer. If they choose to continue, run the scan but **label the numbers as coming from an outdated version** in your report.
 
-**Plugin installs need a restart.** `claude plugin update` writes the new version to disk, but the running session keeps the loaded copy. Tell the user this explicitly — otherwise they update, re-run, and see the same stale numbers with no idea why.
+**Plugin installs need a restart** (only when `installMethod` is `"plugin"`). `claude plugin update` writes the new version to disk, but the running session keeps the loaded copy. Tell the user this explicitly — otherwise they update, re-run, and see the same stale numbers with no idea why.
 
 If `"outdated": false`, say nothing and continue to Phase 1.
 
@@ -50,20 +72,27 @@ If `"outdated": false`, say nothing and continue to Phase 1.
 Run the CLI to collect environment data:
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" scan --json
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim scan --json
 ```
 
-If `CLAUDE_PLUGIN_ROOT` is not set:
-```bash
-PLUGIN_DIR=$(find ~/.claude/plugins -path "*/claude-slim/dist/cli.js" -type f 2>/dev/null | head -1 | xargs dirname | xargs dirname)
-node "$PLUGIN_DIR/dist/cli.js" scan --json
-```
+If that command fails for **any** reason — `node` missing, or the `npx` tier unable to
+reach the npm registry because the machine is offline or behind a proxy — fall back to
+the legacy bash scanner. It needs neither node nor a network:
 
-If `node` is not available, fall back to the legacy bash scanner:
 ```bash
-bash "${CLAUDE_PLUGIN_ROOT}/skills/claude-slim/scripts/scan.sh"
+for d in "${CLAUDE_PLUGIN_ROOT:+$CLAUDE_PLUGIN_ROOT/skills/claude-slim}" "$HOME/.claude/skills/claude-slim" "./.claude/skills/claude-slim"; do
+  [ -n "$d" ] || continue
+  if [ -f "$d/scripts/scan.sh" ]; then bash "$d/scripts/scan.sh" json; exit $?; fi
+done
+echo "claude-slim: no scan.sh found in any known skill directory" >&2
+exit 1
 ```
 
+If this fails too, tell the user the scan could not run and **stop**. Never continue to
+Phase 2 without data: an empty scan is indistinguishable from a clean environment, and
+reporting zeros as fact is the one outcome worse than reporting nothing.
+
 ---
 
 ## Phase 2 — Interpret & Present
@@ -163,18 +192,21 @@ If subcommand is `scan`, stop here. Ask a localized equivalent of "Proceed with
 Run the interactive clean command:
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" clean
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim clean
 ```
 
 Or with dry-run:
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" clean --dry-run
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim clean --dry-run
 ```
 
 After cleanup, re-run scan to get updated numbers, then show the savings report:
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" report
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim report
 ```
 
 Present the report box AND the before/after breakdown table to the user.
@@ -186,7 +218,8 @@ Present the report box AND the before/after breakdown table to the user.
 When `/claude-slim restore` is invoked:
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" restore
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim restore
 ```
 
 ## Doctor
@@ -194,7 +227,8 @@ node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" restore
 When `/claude-slim doctor` is invoked:
 
 ```bash
-node "${CLAUDE_PLUGIN_ROOT}/dist/cli.js" doctor
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim doctor
 ```
 
 Explain warnings in the user's language. Pay special attention to session-log warnings because they explain why unused-skill detection may be suppressed.