Self Reflection 1.1.1

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:12 AM UTC
• Version: 1.0.0

Overview

The skill’s self-reflection purpose is coherent, but its setup tells users to install and repeatedly run an unreviewed executable from a mutable GitHub clone.

Review the remote repository and pin a specific trusted commit before installing; do not symlink or run bin/self-reflection on recurring heartbeats unless you have verified that code. Configure memory and state files in a location you control, and avoid logging secrets, credentials, private customer data, or sensitive incident details.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:80

Finding

Unpinned Remote Payload Installed into the User's Command Path

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 80-83
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

The documented installation process clones a mutable remote repository and creates a symbolic link to an executable that is not included in the audited artifact.

bash

# Clone the skill
git clone https://github.com/hopyky/self-reflection.git ~/.openclaw/skills/self-reflection

# Add to PATH
ln -sf ~/.openclaw/skills/self-reflection/bin/self-reflection ~/bin/self-reflection

The retrieved command is subsequently intended to be invoked automatically through the heartbeat instructions documented in README.md, lines 109-116:

markdown

## Self-Reflection Check (required)

Run `self-reflection check` at each heartbeat.

- If **OK**: Continue normally.
- If **ALERT**: Run `self-reflection read`, reflect, then `self-reflection log`.

Technical Analysis

The git clone command retrieves the repository's mutable default branch without pinning a commit, release tag, cryptographic checksum, or verified signature. The downloaded bin/self-reflection implementation is absent from the supplied audit artifact, so its behavior cannot be verified by this review.

Linking that unreviewed executable into ~/bin makes it available as a normal command. The heartbeat integration then encourages repeated execution. The effective payload can therefore differ from the files reviewed during this audit if the upstream repository changes or is compromised.

This most directly matches T03: Remote Payload Retrieval and Execution: executable code is obtained from an external location, and the code executed by the agent can change after package review.

Attack Path

1. An attacker compromises the upstream repository, its maintainer account, or the repository's mutable default branch.
2. The attacker modifies bin/self-reflection to contain malicious commands.
3. A ...[truncated 1170 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete bin/self-reflection implementation in the distributed and reviewed skill artifact so the executed code matches the audited package.
2. If remote retrieval is unavoidable, pin installation to an immutable, reviewed commit hash rather than cloning the mutable default branch.
3. Publish and verify a cryptographic checksum or signed release before making the executable available in PATH.
4. Use signed commits or release artifacts and document the trusted signing identity and verification procedure.
5. Do not configure recurring heartbeat execution until the retrieved implementation has been integrity-verified and independently reviewed.
6. Avoid linking mutable repository working-tree files directly into ~/bin. Copy a verified artifact into a controlled installation directory instead.
7. Run the command with least privilege and a restricted environment, limiting access to credentials, sensitive files, and unnecessary network resources.
8. Ensure updates require an explicit review and verification step rather than silently changing the code invoked by recurring heartbeats.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 85)May include surrounding context.

Add to PATH

ln -sf ~/.openclaw/skills/self-reflection/bin/self-reflection ~/bin/self-reflection

Create config

cp ~/.openclaw/skills/self-reflection/self-reflection.example.json ~/.openclaw/self-reflection.json

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 200)May include surrounding context.

Configuration

Create ~/.openclaw/self-reflection.json:

json

{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description says the skill performs 'continuous self-improvement' through 'regular heartbeat-triggered reflections,' but it does not clearly constrain when the skill should activate beyond a periodic heartbeat. This broad framing could cause unintended invocation because it lacks specific trigger phrases, scope limits, or exclusion conditions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The skill explicitly stores persistent state and reflective memory in user-home and workspace files, which creates session persistence across runs. While persistence is central to the skill's purpose and appears benign, it can still accumulate sensitive operational details, mistakes, or contextual notes that may later be exposed to other skills, users, or processes if file permissions, retention, or content controls are weak.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

Configuration

Create ~/.openclaw/self-reflection.json:

json

{

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file describes that lessons are logged and persisted, and later shows auto-created files for memory and state storage. However, it does not explicitly warn users near the overview or setup steps that potentially sensitive agent mistakes, lessons, and timestamps will be written to disk, which is relevant to privacy and local data handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.