JuliusBrussee/caveman · error · ValueError

Refusing to compress {filepath}: filename looks sensitive (c

Error message

Refusing to compress {filepath}: filename looks sensitive (credentials, keys, secrets, or known private paths). Compression sends file contents to the Anthropic API. Rename the file if this is a false positive.

What it means

Raised by compress_file() when is_sensitive_path(filepath) matches — the filename looks like it contains credentials, keys, secrets, or known private paths. Because compression sends raw file bytes to the Anthropic API, the script fails loudly rather than silently exfiltrate. The refusal is intentional: the override is to rename the file, not to bypass the check.

Source

Thrown at skills/caveman-compress/scripts/compress.py:291

# ---------- Core Logic ----------


def compress_file(filepath: Path) -> bool:
    # Resolve and validate path
    filepath = filepath.resolve()
    MAX_FILE_SIZE = 500_000  # 500KB
    if not filepath.exists():
        raise FileNotFoundError(f"File not found: {filepath}")
    if filepath.stat().st_size > MAX_FILE_SIZE:
        raise ValueError(f"File too large to compress safely (max 500KB): {filepath}")

    # Refuse files that look like they contain secrets or PII. Compressing ships
    # the raw bytes to the Anthropic API — a third-party boundary — so we fail
    # loudly rather than silently exfiltrate credentials or keys. Override is
    # intentional: the user must rename the file if the heuristic is wrong.
    if is_sensitive_path(filepath):
        raise ValueError(
            f"Refusing to compress {filepath}: filename looks sensitive "
            "(credentials, keys, secrets, or known private paths). "
            "Compression sends file contents to the Anthropic API. "
            "Rename the file if this is a false positive."
        )

    print(f"Processing: {filepath}")

    if not should_compress(filepath):
        print("Skipping (not natural language)")
        return False

    original_text = filepath.read_text(encoding="utf-8", errors="ignore")
    # Store backup outside the source directory so skill auto-loaders don't
    # re-ingest the `.original.md` copy as a live file. Mirror the source's
    # parent-dir name + stem under a platform-aware base to reduce collisions.
    backup_dir = backup_dir_for(filepath)
    backup_path = backup_dir / (filepath.stem + ".original.md")

View on GitHub (pinned to 27d5a3981a)

Solutions

1. If the file genuinely holds secrets: do not compress it — exclude it and use a local (non-LLM) compressor instead.
2. If it is a false positive, rename the file to something that does not match the sensitive heuristic (drop key/secret/credential/pem-style tokens from the name) and re-run.
3. Audit the file's contents first (grep for key material) before deciding it is safe to ship to a third-party API.

Example fix

# before
compress_file(Path('notes/api-keys.md'))  # refused by filename heuristic

# after — verified the file holds no key material, renamed
compress_file(Path('notes/api-auth-design.md'))

import re
SENSITIVE = re.compile(r"(credential|secret|token|\.env|id_rsa|\.pem$|\.key$|password|\.ssh|\.aws)", re.I)

def looks_sensitive(path_str: str) -> bool:
    return bool(SENSITIVE.search(path_str))

try:
    compress_file(path)
except ValueError as e:
    if "looks sensitive" in str(e):
        # inspect the file locally; only rename+retry if truly free of key material
        maybe_rename_if_safe(path)
    raise

When it happens

Trigger: Compressing anything named like .env, id_rsa, credentials.json, *.pem, *.key, tokens.txt, secrets.yaml, or living under a known private path (e.g. ~/.ssh, ~/.aws). The heuristic is filename/path-based, so a false positive on an innocuous file with a scary name also lands here.

Common situations: An agent bulk-compressing a directory that includes dotfiles; a legit doc named 'api-keys-overview.md'; CI trying to condense a config directory containing k8s secrets manifests.

Related errors

• cave_untrusted_tool_definition:${declared.name}
• cave_memory_tenant_invalid
• cave_memory_agent_invalid
• cannot safely launch Windows command shim: ${executable}
• cave_sandbox_credential_capability_ambiguous

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/26b78a63876bd891. Report an issue: GitHub.