Security audit
Security checks for vulnerabilities and agentic risk
The skill’s self-review purpose is legitimate, but it persistently records corrections and reuses lessons across sessions without clear upfront consent, retention limits, or redaction guidance.
Install only if you are comfortable with the agent keeping a persistent local record of corrections and patterns in ~/reflection/. Review those files periodically, avoid letting it store secrets or sensitive project details, and consider adding your own rules for redaction, retention, and deletion before using it broadly.
The trigger scope says the skill applies to "Code, architecture, strategy, any deliverable the user will act on," which is very broad and lacks clear boundaries or negative examples. This makes it unclear when the skill should activate versus when it should stay inactive, increasing the chance of unintended invocation.
The skill encourages logging corrections and detecting patterns across sessions, which can capture user-provided details and reuse them later without clear minimization rules. Because the stored content may include prompts, mistakes, and contextual details, it risks retaining sensitive or identifying information beyond what is necessary for reflection.
The listed triggers include generic phrases like "actually..." and "I meant..." plus the undefined concept of "frustration signals." These are common in everyday conversation and are not specific enough to reliably distinguish true correction events from normal user interaction.
The skill establishes persistent storage in ~/reflection/ and references multiple memory files, but only says the user is informed if they ask. That creates retention without clear upfront notice or consent, which can lead to silent accumulation of sensitive interaction data across sessions.
The instruction to log every correction into persistent files is broad and semantically directs retention of interaction content by default. This can create a durable record of user inputs, misunderstandings, and context that may later be exposed, reused inappropriately, or retained longer than users expect.
Surfacing prior lessons naturally in future conversations can re-disclose stored user-derived information in a new context. Even if intended as helpful memory, mentioning prior projects, mistakes, or domains may leak sensitive historical details to the user unexpectedly or to the wrong conversation context in multi-user/shared environments.
The phrase "heartbeat trigger" is not defined anywhere in the document, so readers cannot tell when this trigger fires or what conditions govern it. This ambiguity weakens activation specificity and may lead to inconsistent or unintended use.
The setup instructions direct the agent to modify persistent local files and create directories under the user's home directory without an explicit warning, consent step, or explanation of filesystem side effects. While the actions are limited and appear related to the skill's stated purpose, undisclosed persistence can surprise users, clutter the environment, and normalize unsafe file-writing behavior in agent skills.
No suspicious patterns detected.
