ClawHub
Back to skill

Security audit

Reflex Arc

Security checks for vulnerabilities and agentic risk

Overview

This skill is a benign prompt-level self-review layer that broadly changes how the agent checks its own answers but does not access external services, store data, or run hidden actions.

Install this only if you want the agent to silently apply broad answer-quality checks to most substantive replies. It does not appear to collect data or use credentials, but it may affect response style and scope across other skills because that is its stated purpose.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The description presents the skill as an active meta-cognitive mechanism that intercepts and improves AI outputs. The actual code does not analyze prompts, responses, contradictions, tone, hallucinations, or scope drift at all. Instead, it is a local diagnostic/status script for verifying installation and structure of a skill package by reading files from standard directories and printing summaries. That is a materially different primary purpose, so this is a clear description-behavior mismatch.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- Add a warning, guard rail, or alternative approach
- If the inversion reveals a fundamental flaw, restructure the entire answer

**Example catch:** Recommending `git push --force` to "fix" a merge conflict.
Inversion: "What guarantees losing work?" Force-pushing. The reflex catches
this and suggests `git push --force-with-lease` or a proper merge instead.
Confidence
70% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Instruction Override

High
Category
Prompt Injection
Content
- NOT a memory system (it stores nothing between conversations)
- NOT a personality layer (it doesn't change the bot's character)
- NOT a rate limiter (it doesn't slow down response time noticeably)
- NOT an override system (it corrects output, it doesn't block it)

## Configuration
Confidence
90% confidence
Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger says to activate on "EVERY response" involving broad categories like specific claims, technical recommendations, multi-step workflows, or ambiguous requests. Those conditions are so expansive that the skill would activate for a large share of ordinary conversations, increasing the risk of unintended invocation despite only a narrow exclusion for trivial exchanges.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| Failure Mode          | Frequency | Root Cause                           |
|-----------------------|-----------|--------------------------------------|
| Hallucination         | Very High | Probabilistic generation without verification |
| Scope creep           | High      | No constraint on response boundaries |
| Contradiction         | Medium    | No cross-reference within conversation |
| Overconfident claims  | High      | No calibration between certainty and expression |
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Skill Enumeration

Medium
Category
Agent Snooping
Content
# Check 1: Locate SKILL.md
SKILL_LOCATIONS=(
  "${HOME}/.openclaw/workspace/skills/reflex-arc/SKILL.md"
  "${HOME}/.moltbot/workspace/skills/reflex-arc/SKILL.md"
  "${HOME}/.clawdbot/workspace/skills/reflex-arc/SKILL.md"
)
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
# Check 1: Locate SKILL.md
SKILL_LOCATIONS=(
  "${HOME}/.openclaw/workspace/skills/reflex-arc/SKILL.md"
  "${HOME}/.moltbot/workspace/skills/reflex-arc/SKILL.md"
  "${HOME}/.clawdbot/workspace/skills/reflex-arc/SKILL.md"
)
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium
Category
Agent Snooping
Content
# Check 1: Locate SKILL.md
SKILL_LOCATIONS=(
  "${HOME}/.openclaw/workspace/skills/reflex-arc/SKILL.md"
  "${HOME}/.moltbot/workspace/skills/reflex-arc/SKILL.md"
  "${HOME}/.clawdbot/workspace/skills/reflex-arc/SKILL.md"
)
Confidence
80% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium
Category
Rogue Agent
Content
echo -e "  ${RED}✗${RESET} SKILL.md not found in standard locations"
  echo ""
  echo "  Install with:"
  echo "    mkdir -p ~/.openclaw/workspace/skills/reflex-arc"
  echo "    cp SKILL.md ~/.openclaw/workspace/skills/reflex-arc/"
  echo ""
fi
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.