ClawHub
Back to skill

Security audit

Taku Reflect

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed reflection tool that stores project learnings, runs git-based retrospectives, and can help author skills, with persistent changes requiring user direction.

Install only if you want a project memory and retrospective workflow. Review any proposed changes to .taku files, AGENTS.md, CLAUDE.md, or skill files before approving them, because those artifacts can influence later agent sessions and may include contributor metadata from git history.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code substantially matches the 'Learn' subfeature described: it records learnings, searches them, identifies prune candidates, exports them, and supports optional bootstrap discovery/installation into project instruction files. However, the declared description claims three modes, including Retro and Write Skill, and those are not present anywhere in this code chunk. That is a material description/behavior mismatch because major advertised capabilities are unimplemented here. Additionally, bootstrap-install writes to AGENTS.md/CLAUDE.md, which is a meaningful file-modification capability not reflected in the empty declared permissions. The trigger language about invoking on satisfaction/frustration is not evidenced by this script, but trigger handling may live elsewhere; the stronger mismatch is the missing major modes.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
94% confidence
Finding

The skill explicitly offers a 'Write Skill' mode to codify patterns into reusable skills, which is a form of agent self-modification or capability extension. Even with user invocation, generating new skills can create persistent new behaviors, broaden tool use, or encode unsafe logic that influences later sessions.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md
User-invoked reflection. Three modes: Learn (script-backed recording, searching,
  pruning, exporting, and optional bootstrap for user-approved patterns, pitfalls,
  preferences, discoveries), Retro (weekly engineering retrospective with git commit analysis,
  metrics, team breakdowns, trends), and Write Skill (codify recurring learnings into reusable skills).
  Triggers on "what have we learned", "add learning", "show learnings", "weekly retro",
  "what did we ship", "engineering retrospective", "write a skill", "create a skill",
  "codify this pattern", "总结一下", "学到了什么", "记录一下", "回顾这周",

Self-Modification

High
Category
Rogue Agent
Confidence
94% confidence
Finding

This section reiterates that one operating mode is to create reusable skills, reinforcing that the skill is designed to produce persistent behavioral artifacts. Persistent prompt/code generation for future agent execution materially increases the attack surface and the chance of embedding unsafe instructions.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
- Grep
---

# Reflect — Learn + Retro + Write Skill

Three modes: capture learnings (default), weekly retrospective, or codify recurring patterns into skills.

Self-Modification

High
Category
Rogue Agent
Confidence
96% confidence
Finding

The specific trigger 'edit this skill' authorizes modification of an existing skill, which is riskier than creating a fresh draft because it can alter trusted behavior in place. An attacker or confused user could induce changes to a loaded skill and thereby change future agent conduct without adequate review boundaries.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
- **Learn** (default): "what have we learned", "add learning", "show learnings", "prune learnings"
- **Retro**: "weekly retro", "what did we ship", "retrospective", or `--retro` flag
- **Write Skill**: "write a skill", "create a skill", "codify this pattern", "edit this skill"

---

Self-Modification

High
Category
Rogue Agent
Confidence
96% confidence
Finding

The specific trigger 'edit this skill' authorizes modification of an existing skill, which is riskier than creating a fresh draft because it can alter trusted behavior in place. An attacker or confused user could induce changes to a loaded skill and thereby change future agent conduct without adequate review boundaries.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
- **Learn** (default): "what have we learned", "add learning", "show learnings", "prune learnings"
- **Retro**: "weekly retro", "what did we ship", "retrospective", or `--retro` flag
- **Write Skill**: "write a skill", "create a skill", "codify this pattern", "edit this skill"

---

Hidden Instructions

High
Category
Prompt Injection
Confidence
90% confidence
Finding

The bootstrap protocol injects persistent instructions into AGENTS.md or CLAUDE.md that affect future agent behavior outside this session. Although marker comments are visible to humans, the block functions as a durable hidden control plane for downstream agents and can silently expand memory-consultation behavior across future runs.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

Protocol block: The script owns this exact block.

md
<!-- TAKU_LEARNINGS_PROTOCOL:START -->
## Taku Learnings

If `.taku/learnings/{project-slug}.jsonl` exists, consult it before non-trivial planning, implementation, review, or debugging. Treat matching entries as context, not hard rules.

Self-Modification

High
Category
Rogue Agent
Confidence
94% confidence
Finding

The dedicated Write Skill mode formalizes persistent skill generation as part of normal operation. In the context of an agent framework, this is materially dangerous because it lets a session transform transient observations into reusable instructions that can steer later executions.

Content

Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.

md
---

## Write Skill Mode

Codify recurring patterns into reusable skills, but only after the user confirms they want to write one.

Self-Modification

High
Category
Rogue Agent
Confidence
91% confidence
Finding

Suggesting promotion of recurring patterns into a skill creates an escalation path from benign notes to durable agent behavior. While the text requires asking first, it still encourages migration from ephemeral reflection into persistent instruction artifacts, which can normalize unsafe self-extension.

Content

Scanner excerpt · SKILL.md (reported line 245)May include surrounding context.

md
- Suggestion: propose upgrading the preference into `AGENTS.md` if present, otherwise `CLAUDE.md`
   - Rule: never write the file automatically; ask the user first

2. **Write Skill candidate**
   - Condition: the same pattern, pitfall, or decision method recurs across 2-3 sprints
   - Suggestion: `This pattern keeps recurring. Suggest codifying it as a skill.`
   - Rule: ask the user whether to proceed before loading `references/writing-skills.md`

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

The explicit trigger phrase "edit this skill" enables self-modification behavior, where the agent may apply instructions that alter the very skill governing its behavior. Self-referential editing is dangerous because it can weaken safeguards, introduce recursive policy drift, or allow prompt-injection-style requests to reshape future agent conduct. This is more dangerous in context because the file teaches how to write and verify skills, so misuse could affect many downstream skills and amplify errors.

Content

Scanner excerpt · references/writing-skills.md (reported line 5)May include surrounding context.

md
name: taku-write-skill
description: >
  Use when creating new skills, editing existing skills, or verifying skills work
  before deployment. Triggers on "write a skill", "create a skill", "edit this skill",
  "is this skill correct", "test this skill", or when the reflect phase needs to
  codify a learned pattern into reusable documentation.
---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill declares broad automatic triggers based on a user's satisfaction or frustration, which can cause invocation without clear, informed intent. Because Learn mode can write durable project memory and Retro mode can analyze repository history, this expands the chance of unsolicited data collection or file modification during ordinary conversation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Retro mode instructs the agent to read git author names/emails and save reports under .taku/retros, but the skill description does not prominently disclose that identity-linked metadata will be analyzed and persisted. This reduces informed consent and may expose contributor information or work-pattern summaries in repositories where such reporting was not expected.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.

md
*Prevention:* Auto-search relevant learnings in later phases as context. Query the knowledge base, don't just write to it.

**Auto-upgrading without consent.** A repeated preference was detected and silently written into a project rule file. The user disagreed with the wording and had to undo it.

*Prevention:* Promotion Suggestions are suggestions only. Upgrades to `AGENTS.md`, `CLAUDE.md`, or a new skill always require explicit user confirmation first.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description uses broad trigger phrases such as creating, editing, verifying, and testing skills, which can match a wide range of ordinary requests. Over-broad activation can cause the agent to load and apply this skill in unintended contexts, including validation or editing tasks where self-referential or policy-shaping behavior is risky. In this file's context, the danger is increased because the skill influences how new skills are authored and verified, so accidental invocation can propagate weak or unsafe conventions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The bootstrap-install command appends a protocol block directly into AGENTS.md or CLAUDE.md with no confirmation prompt, dry-run safeguard, or explicit warning that project instruction files will be modified. In this skill’s context, those files influence future agent behavior, so a user-triggered but insufficiently guarded write can silently persist behavior changes and create instruction-injection risk or unexpected workflow changes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The manifest hard-codes both English and Chinese trigger phrases, but the skill does not explain language selection or offer a user language preference mechanism. This can violate a language/locale policy when multilingual behavior is imposed without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.