/strategy-compact

name: strategy-compact
description: Suggests manual context compaction at logical intervals to preserve context through task phases rather than arbitrary auto-compaction.

Strategic Compact for Offensive Security

CTF and offsec sessions are long-form by nature — multi-hour engagements with heavy tool output, iterative exploitation, and chained attack paths. Auto-compaction is destructive in this context because it fires at arbitrary points and silently drops exploit state, payload bytes, and enumeration results. This skill teaches when and how to compact strategically so you keep attacking momentum without context rot.

When to Activate

• Any CTF challenge, HTB machine, or pentest session
• Session approaching context limits (responses getting shorter, losing track of prior findings)
• After hitting a natural phase boundary (see below)
• After 3+ failed strategies in the same category — compact the dead-end reasoning

Why This Matters for Offsec

Auto-compaction in a CTF session can:

• **Mangle CVE payloads** — null bytes, backticks, escape sequences get stripped by markdown summarization
• **Lose enumeration context** — which ports you already checked, which creds you already tried
• **Break multi-step exploit chains** — partial state from stage 1 vanishes before stage 2
• **Repeat failed strategies** — without the failure context, you try the same dead-end again

Strategic compaction at phase boundaries avoids all of this because Neo4j graph data and workspace files persist independently.

CTF Phase Model and Compact Points

Recon --> Enumeration --> Initial Access --> Post-Exploit Enum --> Lateral/Privesc --> Flag

Natural Compact Points

| After this phase... | Compact? | Why | |---------------------|----------|-----| | Full port scan + service enum | **Yes** | Nmap/gobuster output is massive. Findings are in Neo4j — you don't need raw output in context | | Failed exploit chain (3+ attempts) | **Yes** | Dead-end reasoning pollutes context. Update attempts as `failed` in Neo4j first, then compact with fresh approach | | Got initial shell + posted creds/shell | **Yes** | New user = fresh enumeration cycle. Prior exploitation context is noise now | | Got new user (lateral movement) | **Yes** | Same as above — record creds/shell in Neo4j, compact, re-enumerate as new identity | | Pivoting to completely different service | **Yes** | Web exploit context is useless for binary exploitation and vice versa |

Never Compact During

| Situation | Why | |-----------|-----| | Mid-exploit (payload assembled, not yet fired) | Payload bytes will be mangled or lost | | Active binary analysis (offsets, gadgets identified) | ROP chains, canary values, libc offsets are hard to reconstruct | | Multi-step CVE chain in progress | Intermediate state (tokens, session cookies, CSRF values) will vanish | | Debugging a specific failure | Error context and hypothesis state are essential |

Pre-Compact Checklist

**Before running `/compact`, verify all of these. Skipping any item means losing that state permanently:**

1. **Neo4j graph updated** — All findings (ports, creds, vulns, shells) written via `mcp__neo4j__write_cypher`; all attempt outcomes current 2. **Failed approaches documented** — Every failed or abandoned attempt updated in Neo4j with `outcome: 'failed'` and `output_summary` 3. **Working exploits saved** — Any exploit script saved to `/workspace/` (not just in conversation history) 4. **CVE payloads preserved** — Payloads with special characters (null bytes, backticks, binary data) saved to file, not just in chat 5. **Credential chain documented** — Which creds grant access to which services recorded as `credential` nodes with `AUTHENTICATES_TO` relationships 6. **Current hypothesis noted** — What you think the next step is — include in compact summary message

Post-Compact Recovery

After compacting, `compact-state.md` (auto-generated by PreCompact hook) provides orientation — target name, actual credential/service data, failed attempts, and recent command history. Run this sequence:

1. Read compact-state.md (if it exists)         <- target name + actual data snapshot
2. mcp__neo4j__read_cypher:                      <- full structured state
   MATCH (t:target)-[r*1..3]-(n)
   UNWIND r AS rel
   RETURN DISTINCT labels(n)[0] AS type, n.key AS key, properties(n) AS props
   ORDER BY type, key
3. ls /workspace/                               <- saved exploit scripts and notes
4. Read MEMORY.md                               <- auto-loaded, check for target-specific notes

`compact-state.md` gives you the quick orientation (creds, shells, what failed, recent commands). The recovery Cypher gives the full structured data. Together = full continuity.

Compact Summary Messages

Always use `/compact` with a targeted summary. Generic summaries lose critical state.

**Bad:** `/compact` (no message) **Bad:** `/compact Working on HTB machine` **Good:** `/compact Got shell as www-data via SQLi on port 80. Creds for mysql user in DB. Next: enumerate internal services for lateral movement to user tom. Exploit script at /workspace/sqli.py`

The summary becomes your session's "load-bearing context" — everything else is rebuilt from Neo4j and files.

What Survives Compaction

| Persists | Lost | |----------|------| | Neo4j graph (ports, creds, vulns, attempts, strategies, command_log) | Raw tool output (nmap, gobuster, etc.) | | Workspace files (`/workspace/*.py`, notes, exploits) | Intermediate reasoning and analysis | | Memory files (`MEMORY.md`, topic files) | Payload bytes in conversation history | | CLAUDE.md + skill instructions | Multi-step conversation context | | Git state (commits, branches) | User-stated preferences from this session | | TodoWrite task list | Nuanced failure analysis ("it failed because...") | | `/compact` summary message | Everything else |

Controlling Auto-Compaction (Claude Code Internals)

Auto-compaction cannot be fully replac