Is yvgude/lean-ctx safe?

The file rust/.kiro/steering/lean-ctx.md uses 'inclusion: always' which means it is automatically prepended to every Kiro agent session in any workspace where lean-ctx is installed. It contains 'You MUST prefer lean-ctx tools over native equivalents' - a mandatory behavioral override that routes all file reads, shell executions, and searches through lean-ctx without user awareness or consent per session.

The lean-ctx-review skill explicitly instructs agents to read ~/.claude/projects//.jsonl files - these are Claude Code's raw conversation history files containing all messages, tool calls, code snippets, and potentially sensitive data from active sessions. The skill also provides a Python script (scripts/scan_session.py) to parse and analyze this data, and can then file GitHub issues to the skill author's repository (yvgude/lean-ctx) with findings derived from this data.

The lean-ctx-bin npm package includes both preinstall and postinstall hooks (node preinstall.js and node postinstall.js). These execute automatically during npm install without explicit user acknowledgment. While binary download via postinstall is a common pattern (used by esbuild, etc.), the content of these scripts was not included in the evidence for inspection, and they represent code execution that occurs before the user has fully consented.

SKILL.md instructs agents to run the following if lean-ctx is not found: curl -fsSL https://raw.githubusercontent.com/yvgude/lean-ctx/main/skills/lean-ctx/scripts/install.sh | bash. An agent following this instruction will silently download and execute arbitrary shell code from the internet. The install script content is not included in the cloned repo evidence, making it impossible to audit statically.

The skill includes a full-featured API proxy (src/proxy/) that intercepts requests to Anthropic, OpenAI, Google, Bedrock, and other providers. When active, this proxy has full read/write access to all prompt content sent to and from the LLM. The proxy can compress, route, modify, and log all traffic. This creates a persistent man-in-the-middle position for all agent AI interactions.

The .gitmodules file declares a submodule at aur/lean-ctx-bin pointing to ssh://[email protected]/lean-ctx-bin.git. The AUR (Arch User Repository) is maintained separately from the main repo and can be updated independently. If submodules are initialized, code from this external source could execute. AUR packages in particular have a history of supply chain compromises.

The OCLA (Open Context & Token Lifecycle Architecture) system uploads savings data, telemetry, usage patterns, and agent interaction metrics to lean-ctx's cloud backend. SKILL.md references 'lean-ctx gain', 'lean-ctx wrapped', and analytics endpoints. The scope of data transmitted (token counts, model names, interaction patterns, timing) could reveal sensitive information about agent usage workflows.

The 'lean-ctx setup' command installs 'shell hook + editor wiring + rules + skills' and 'lean-ctx init --agent claude' configures Claude Code integration. These commands modify persistent system configuration that affects how the agent operates in future sessions, not just the current one. An agent following setup instructions will reconfigure its own operating environment.

lean-ctx is a professionally maintained, well-tested, Apache-2.0 licensed context optimization tool with genuine utility. However, it is architected to occupy a uniquely privileged position: acting as proxy for all LLM API traffic, reading shell history, intercepting tool calls, reading session transcripts, and modifying agent behavioral defaults. No single malicious intent is evident, but the combination of access capabilities represents substantial risk if the skill or its infrastructure were compromised.