claude-slim 2.14.0 → 2.14.2

package/README.md

@@ -7,6 +7,7 @@
 [![CI](https://github.com/iops-leo/claude-slim/actions/workflows/ci.yml/badge.svg)](https://github.com/iops-leo/claude-slim/actions/workflows/ci.yml)
 [![node](https://img.shields.io/node/v/claude-slim.svg)](https://nodejs.org)
 [![license](https://img.shields.io/npm/l/claude-slim.svg)](./LICENSE)
+[![skills.sh](https://skills.sh/b/iops-leo/claude-slim)](https://skills.sh/iops-leo/claude-slim)
 
 **Your Claude Code session burns thousands of tokens before you even say "hello."**
 

package/dist/scanner/index.js

@@ -20,6 +20,7 @@ import { scanPluginSurfaces } from './plugin-surfaces.js';
 import { computePluginBreakdown } from './plugin-breakdown.js';
 import { computePluginCosts } from './plugin-cost.js';
 import { scanUserSurfaces } from './user-surfaces.js';
+import { sanitizeScanResult } from './untrusted.js';
 const DEFAULT_LOOKBACK_DAYS = 60;
 export async function scan(opts = {}) {
     const lookbackDays = opts.lookbackDays ?? DEFAULT_LOOKBACK_DAYS;
@@ -149,7 +150,10 @@ export async function scan(opts = {}) {
         pluginSkillListingTokens.set(c.pluginName, (pluginSkillListingTokens.get(c.pluginName) ?? 0) + c.skillTokens);
     }
     const recoverableStartupTokens = sumRecoverableStartupTokens(issues, [...localSkills, ...pluginSkills], currentProjectSlug, pluginSkillListingTokens);
-    return {
+    // Labels below are authored by whoever wrote each skill, plugin, or memory
+    // file, and they reach the agent's context through the report. Flatten them
+    // at this one exit rather than at each site that reads a name off disk.
+    return sanitizeScanResult({
         localSkills,
         pluginSkills,
         plugins,
@@ -171,7 +175,7 @@ export async function scan(opts = {}) {
         allProjectsMemoryTokens,
         recoverableStartupTokens,
         disabledPluginSkillTokens,
-    };
+    });
 }
 async function pathExists(p) {
     try {

package/dist/scanner/untrusted.d.ts

@@ -0,0 +1,30 @@
+import type { ScanResult } from '../types.js';
+/**
+ * Names read off disk are written by whoever authored the skill, plugin, or
+ * memory file — not by the user running the scan. They flow through the report
+ * into the agent's context, which makes them an indirect prompt injection
+ * surface: a skill directory or frontmatter `name:` can carry instructions
+ * aimed at the model rather than a label aimed at a human.
+ *
+ * Snyk's audit of this skill (W011, medium 0.30) is about exactly this path.
+ * The scan never emits file *bodies* — descriptions are measured for token cost
+ * and then discarded — so what this module covers is the whole exposed surface,
+ * not a sample of it.
+ */
+/** Longest label we render. Real names are far shorter; payloads are not. */
+export declare const MAX_NAME_LENGTH = 120;
+/**
+ * Collapse an untrusted label to a single bounded, printable line.
+ *
+ * Deliberately not an escape or an encoding: the value is a display label, and
+ * a reversible transform would relocate a payload rather than remove it.
+ */
+export declare function sanitizeUntrusted(value: string, max?: number): string;
+/**
+ * Return a copy of the scan with every outsider-authored label flattened.
+ *
+ * Applied once at the scanner's exit rather than at each of the dozen sites
+ * that read a name off disk: one chokepoint cannot be forgotten by whoever adds
+ * the next detector.
+ */
+export declare function sanitizeScanResult(result: ScanResult): ScanResult;

package/dist/scanner/untrusted.js

@@ -0,0 +1,101 @@
+/**
+ * Names read off disk are written by whoever authored the skill, plugin, or
+ * memory file — not by the user running the scan. They flow through the report
+ * into the agent's context, which makes them an indirect prompt injection
+ * surface: a skill directory or frontmatter `name:` can carry instructions
+ * aimed at the model rather than a label aimed at a human.
+ *
+ * Snyk's audit of this skill (W011, medium 0.30) is about exactly this path.
+ * The scan never emits file *bodies* — descriptions are measured for token cost
+ * and then discarded — so what this module covers is the whole exposed surface,
+ * not a sample of it.
+ */
+/** Longest label we render. Real names are far shorter; payloads are not. */
+export const MAX_NAME_LENGTH = 120;
+/** C0/C1 controls, including the newlines that would forge new report rows. */
+const CONTROL_CHARS = /[\u0000-\u001F\u007F-\u009F]/g;
+/**
+ * Zero-width and bidi-override characters: invisible to the human reading the
+ * report, fully visible to the model reading the same string.
+ */
+const INVISIBLE = /[\u200B-\u200F\u202A-\u202E\u2060-\u2064\u2066-\u2069\uFEFF]/g;
+/**
+ * Collapse an untrusted label to a single bounded, printable line.
+ *
+ * Deliberately not an escape or an encoding: the value is a display label, and
+ * a reversible transform would relocate a payload rather than remove it.
+ */
+export function sanitizeUntrusted(value, max = MAX_NAME_LENGTH) {
+    const flattened = value
+        .replace(CONTROL_CHARS, ' ')
+        .replace(INVISIBLE, '')
+        .replace(/\s+/g, ' ')
+        .trim();
+    if (flattened.length <= max)
+        return flattened;
+    return `${flattened.slice(0, max)}…`;
+}
+/**
+ * Paths are shown to the user and used to locate files for cleanup, so they are
+ * flattened but never truncated — a shortened path would be a wrong path.
+ */
+function sanitizePath(value) {
+    return value.replace(CONTROL_CHARS, ' ').replace(INVISIBLE, '').trim();
+}
+/**
+ * Return a copy of the scan with every outsider-authored label flattened.
+ *
+ * Applied once at the scanner's exit rather than at each of the dozen sites
+ * that read a name off disk: one chokepoint cannot be forgotten by whoever adds
+ * the next detector.
+ */
+export function sanitizeScanResult(result) {
+    const skill = (s) => ({
+        ...s,
+        name: sanitizeUntrusted(s.name),
+        path: sanitizePath(s.path),
+    });
+    return {
+        ...result,
+        localSkills: result.localSkills.map(skill),
+        pluginSkills: result.pluginSkills.map(skill),
+        plugins: result.plugins.map((p) => ({
+            ...p,
+            name: sanitizeUntrusted(p.name),
+            skills: p.skills.map((s) => sanitizeUntrusted(s)),
+        })),
+        brokenSymlinks: result.brokenSymlinks.map((b) => ({
+            ...b,
+            name: sanitizeUntrusted(b.name),
+            path: sanitizePath(b.path),
+            target: sanitizeUntrusted(b.target),
+        })),
+        memoryFiles: result.memoryFiles.map((m) => ({
+            ...m,
+            project: sanitizeUntrusted(m.project),
+            name: sanitizeUntrusted(m.name),
+            path: sanitizePath(m.path),
+        })),
+        claudeMdSections: result.claudeMdSections.map((s) => ({
+            ...s,
+            name: sanitizeUntrusted(s.name),
+        })),
+        mcpServerNames: result.mcpServerNames.map((n) => sanitizeUntrusted(n)),
+        issues: result.issues.map((i) => ({
+            ...i,
+            name: sanitizeUntrusted(i.name),
+            path: sanitizePath(i.path),
+            ...(i.detail === undefined ? {} : { detail: sanitizeUntrusted(i.detail) }),
+            ...(i.marketplace === undefined
+                ? {}
+                : { marketplace: sanitizeUntrusted(i.marketplace) }),
+        })),
+        pluginBreakdown: result.pluginBreakdown.map((p) => ({
+            ...p,
+            name: sanitizeUntrusted(p.name),
+            marketplace: sanitizeUntrusted(p.marketplace),
+        })),
+        userAgents: result.userAgents.map((a) => ({ ...a, name: sanitizeUntrusted(a.name) })),
+        userCommands: result.userCommands.map((c) => ({ ...c, name: sanitizeUntrusted(c.name) })),
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-slim",
-  "version": "2.14.0",
+  "version": "2.14.2",
   "description": "Audit and shrink your Claude Code startup context. Measures what every skill, plugin, agent, command, and memory file costs in the system prompt, then reversibly disables the dead weight. Non-destructive scan, tiered proposals, one-command restore — no proxy, no compression.",
   "type": "module",
   "bin": {

package/skills/claude-slim/SKILL.md

@@ -27,6 +27,14 @@ block does not survive into the next. It resolves in three tiers — the plugin'
 `npx`. That last tier is what makes the skill work when it was installed by
 `npx skills add` rather than `claude plugin install`, where no plugin root exists.
 
+The `npx` tier pins a **minimum version, not just a major**. `claude-slim@^2` looks
+safer but is worse: npx reuses any cached `_npx` install that satisfies the range and
+never re-checks the registry, so a machine that once fetched an older 2.x keeps running
+it — a security fix would never arrive. `--prefer-online` does not override this. Pinning
+to the exact release changes the cache key every time, which forces a fresh fetch while
+still refusing an unreviewed next major. `npm run check:versions` keeps this pin equal to
+`package.json`, so bump them together.
+
 Do not shorten the name. A two-letter `cs` collides with claude-squad's binary, and a
 shell function is invisible to `timeout`, `env`, and `xargs` — a wrapped call would
 silently run that other program instead. Call `claude_slim` directly, never through a
@@ -39,7 +47,7 @@ wrapper.
 An outdated claude-slim does not merely lack features — it reports **wrong numbers**. Versions before 2.8.0 summed memory across every project on disk and inflated the startup estimate roughly 8×. Presenting those figures as fact is worse than not running at all, so check first:
 
 ```bash
-claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.2' "$@"; fi; }
 claude_slim check-update --json
 ```
 
@@ -72,7 +80,7 @@ If `"outdated": false`, say nothing and continue to Phase 1.
 Run the CLI to collect environment data:
 
 ```bash
-claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.2' "$@"; fi; }
 claude_slim scan --json
 ```
 
@@ -192,20 +200,20 @@ If subcommand is `scan`, stop here. Ask a localized equivalent of "Proceed with
 Run the interactive clean command:
 
 ```bash
-claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.2' "$@"; fi; }
 claude_slim clean
 ```
 
 Or with dry-run:
 ```bash
-claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.2' "$@"; fi; }
 claude_slim clean --dry-run
 ```
 
 After cleanup, re-run scan to get updated numbers, then show the savings report:
 
 ```bash
-claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.2' "$@"; fi; }
 claude_slim report
 ```
 
@@ -218,7 +226,7 @@ Present the report box AND the before/after breakdown table to the user.
 When `/claude-slim restore` is invoked:
 
 ```bash
-claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.2' "$@"; fi; }
 claude_slim restore
 ```
 
@@ -227,7 +235,7 @@ claude_slim restore
 When `/claude-slim doctor` is invoked:
 
 ```bash
-claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2' "$@"; fi; }
+claude_slim(){ if [ -n "${CLAUDE_PLUGIN_ROOT:-}" ] && [ -f "$CLAUDE_PLUGIN_ROOT/dist/cli.js" ]; then node "$CLAUDE_PLUGIN_ROOT/dist/cli.js" "$@"; elif command -v claude-slim >/dev/null 2>&1; then claude-slim "$@"; else npx -y 'claude-slim@^2.14.2' "$@"; fi; }
 claude_slim doctor
 ```