Agent Reflect Temp

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:15 AM UTC
• Version: 1.0.0

Overview

This skill is openly a self-improvement tool, but it can persistently change agent instructions and create skills from conversation-derived content, so users should review it carefully before installing.

Install only if you specifically want a skill that can turn session feedback into persistent agent behavior. Before approving any proposed change, inspect the exact source quote, target path, and diff; avoid approving global ~/.claude changes or new skill creation unless you deliberately want that behavior across future sessions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:130

Finding

Conversation-Derived Rules Can Poison Persistent Agent Instructions

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:13

Finding

Unrestricted Shell and Broad Filesystem Permissions Exceed the Skill’s Core Requirements

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase includes very generic natural-language commands like "reflect" and "review session," which can be invoked accidentally during ordinary conversation rather than as an intentional administrative action. In this skill's context, unintended invocation is more concerning because the feature analyzes prior conversations and proposes persistent agent-definition changes, so a mistaken trigger could initiate sensitive self-modification workflows or surface session content unexpectedly.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 84% confidence

Finding

The trigger phrase 'review session' overlaps semantically with built-in 'review' workflows and may be invoked unintentionally when a user asks for a session review. Because this skill can write persistent state and potentially modify instructions, command shadowing raises the risk of activating a more privileged, stateful behavior than the user intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad natural-language phrases such as 'what did I learn' and 'analyze corrections' that can plausibly appear in ordinary conversation. Because this skill has write/edit capabilities and is designed to persist changes, accidental activation could cause unsolicited analysis or preparation of persistent modifications.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The skill is granted Write, Edit, and Bash, and its metadata configures a persistent state directory under '~/.reflect'. This combination gives the skill both the means and the stated intent to store state and alter files across sessions, creating durable behavioral changes and increasing the blast radius of accidental or unsafe invocation.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

- analyze corrections
allowed-tools:
  - Read
  - Write
  - Edit
  - Grep
  - Glob

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The usage guidance says to use the skill 'after completing complex tasks' and 'at session boundaries,' which broadens activation beyond clear user commands. In a self-modifying skill with persistent storage and edit permissions, ambiguous activation conditions increase the chance of unintended reflection runs and collection of conversation content for persistence.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The documented output locations include versioned project reflections, new skills under '.claude/skills/{name}/SKILL.md', and global learning logs in the user's home directory. Even with stated guardrails, this is an explicit persistence mechanism that can propagate learned instructions into future sessions and projects, making mistakes or poisoned learnings durable.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md

### Incremental Updates
- ONLY add to existing sections
- NEVER delete or rewrite existing rules
- Preserve original structure

### Conflict Detection

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The troubleshooting guidance explicitly allows creating missing agent files, which expands the skill from updating known targets to generating new persistent instruction files. In context, this is a self-improvement skill intended to encode learnings permanently, so the ability to create agent files materially increases persistence and the risk of unauthorized long-term behavior changes.

Content

Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.

md

**Agent file not found:**
- Check agent name spelling
- May need to create agent file first

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The file explicitly instructs the system to permanently encode new learnings into agent definitions and even create new sections when none match. In a reflection skill, this creates durable prompt/state persistence: adversarial or low-quality session content could be transformed into long-lived agent instructions, causing prompt injection persistence and policy drift across future sessions.

Content

Scanner excerpt · agent_mappings.md (reported line 153)May include surrounding context.

md

1. Most specific matching section (e.g., "Security" for security rules)
2. Generic "Heuristics" section
3. "Guidelines" or "Rules" section
4. Create new section if none match

### Addition Format

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · agent_mappings.md (reported line 284)May include surrounding context.

md

**Category**: New Skill

**Mapping**:
- Create: `.claude/skills/react-hydration-mismatch-fix/SKILL.md`
- Include: Error message, symptoms, step-by-step fix, verification

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented detection rules rely on very broad lexical triggers such as "always," "must," "good," and "nice" with limited scoping or disambiguation requirements. In a self-improvement skill that permanently encodes learnings into agent definitions, this can cause ordinary conversational language to be misclassified as durable rules or approvals, leading to prompt/data poisoning of the agent's long-term behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest explicitly advertises 'Encodes learnings permanently into agent definitions for continuous improvement across all future sessions' without a strong warning or explicit consent boundary. Persistent modification of agent definitions is high risk because a mistaken reflection, prompt injection captured as a 'learning', or accidental invocation can silently alter future behavior beyond the current session.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are generic conversational language such as 'reflect' and 'review session', which can be invoked unintentionally during normal interaction. In a meta-skill that can analyze sessions and drive persistent agent changes, accidental activation expands the chance of unauthorized or surprising behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.