ClawHub
Back to skill

Security audit

Reflex Arc

Security checks for vulnerabilities and agentic risk

Overview

This skill is a benign prompt-level self-review layer that broadly changes how the agent checks its own answers but does not access external services, store data, or run hidden actions.

Install this only if you want the agent to silently apply broad answer-quality checks to most substantive replies. It does not appear to collect data or use credentials, but it may affect response style and scope across other skills because that is its stated purpose.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The description presents the skill as an active meta-cognitive mechanism that intercepts and improves AI outputs. The actual code does not analyze prompts, responses, contradictions, tone, hallucinations, or scope drift at all. Instead, it is a local diagnostic/status script for verifying installation and structure of a skill package by reading files from standard directories and printing summaries. That is a materially different primary purpose, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md
- Add a warning, guard rail, or alternative approach
- If the inversion reveals a fundamental flaw, restructure the entire answer

**Example catch:** Recommending `git push --force` to "fix" a merge conflict.
Inversion: "What guarantees losing work?" Force-pushing. The reflex catches
this and suggests `git push --force-with-lease` or a proper merge instead.

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

md
- NOT a memory system (it stores nothing between conversations)
- NOT a personality layer (it doesn't change the bot's character)
- NOT a rate limiter (it doesn't slow down response time noticeably)
- NOT an override system (it corrects output, it doesn't block it)

## Configuration

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger says to activate on "EVERY response" involving broad categories like specific claims, technical recommendations, multi-step workflows, or ambiguous requests. Those conditions are so expansive that the skill would activate for a large share of ordinary conversations, increasing the risk of unintended invocation despite only a narrow exclusion for trivial exchanges.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/methodology.md (reported line 21)May include surrounding context.

md
| Failure Mode          | Frequency | Root Cause                           |
|-----------------------|-----------|--------------------------------------|
| Hallucination         | Very High | Probabilistic generation without verification |
| Scope creep           | High      | No constraint on response boundaries |
| Contradiction         | Medium    | No cross-reference within conversation |
| Overconfident claims  | High      | No calibration between certainty and expression |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/reflex-check.sh (reported line 26)May include surrounding context.

sh
# Check 1: Locate SKILL.md
SKILL_LOCATIONS=(
  "${HOME}/.openclaw/workspace/skills/reflex-arc/SKILL.md"
  "${HOME}/.moltbot/workspace/skills/reflex-arc/SKILL.md"
  "${HOME}/.clawdbot/workspace/skills/reflex-arc/SKILL.md"
)

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/reflex-check.sh (reported line 27)May include surrounding context.

sh
# Check 1: Locate SKILL.md
SKILL_LOCATIONS=(
  "${HOME}/.openclaw/workspace/skills/reflex-arc/SKILL.md"
  "${HOME}/.moltbot/workspace/skills/reflex-arc/SKILL.md"
  "${HOME}/.clawdbot/workspace/skills/reflex-arc/SKILL.md"
)

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/reflex-check.sh (reported line 28)May include surrounding context.

sh
# Check 1: Locate SKILL.md
SKILL_LOCATIONS=(
  "${HOME}/.openclaw/workspace/skills/reflex-arc/SKILL.md"
  "${HOME}/.moltbot/workspace/skills/reflex-arc/SKILL.md"
  "${HOME}/.clawdbot/workspace/skills/reflex-arc/SKILL.md"
)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/reflex-check.sh (reported line 50)May include surrounding context.

sh
echo -e "  ${RED}✗${RESET} SKILL.md not found in standard locations"
  echo ""
  echo "  Install with:"
  echo "    mkdir -p ~/.openclaw/workspace/skills/reflex-arc"
  echo "    cp SKILL.md ~/.openclaw/workspace/skills/reflex-arc/"
  echo ""
fi