self-reflection-loop

• Outcome: Review
• Latest audit: Aug 14, 2026 · 1:44 AM UTC
• Version: 1.0.0

Overview

This skill is a plausible self-review tool, but it gives agents under-scoped shell execution and persistent learning behavior that users should review before installing.

Install only if you are comfortable with a skill that can run user-supplied shell commands during refinement and keep local cross-run usage/preference data. Prefer using assess/init without --refine-cmd, review any refine command manually, and periodically inspect or delete learned_patterns.json if you do not want retained history.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (15)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 自动整改：把本轮缺口作为上下文交给 refine 命令，产出下一版产物
                gap_txt = "; ".join(g["rectify"] for g in res["gaps"])
                cmd = a.refine_cmd.replace("{artifact}", cur).replace("{gaps}", gap_txt)
                r = subprocess.run(cmd, shell=True, capture_output=True, text=True)
                nxt = (r.stdout or "").strip().splitlines()
                nxt = nxt[-1] if nxt else ""
                if nxt and os.path.exists(nxt):

• Confidence: 99% confidence
• Finding: The loop mode builds a shell command from user-controlled inputs and executes it with shell=True. Both {artifact} and {gaps} can carry shell metacharacters into the final command, enabling arbitrary command execution in the context of the process.

Tainted flow: 'cmd' from open (line 173, file read) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

# 自动整改：把本轮缺口作为上下文交给 refine 命令，产出下一版产物
                gap_txt = "; ".join(g["rectify"] for g in res["gaps"])
                cmd = a.refine_cmd.replace("{artifact}", cur).replace("{gaps}", gap_txt)
                r = subprocess.run(cmd, shell=True, capture_output=True, text=True)
                nxt = (r.stdout or "").strip().splitlines()
                nxt = nxt[-1] if nxt else ""
                if nxt and os.path.exists(nxt):

• Confidence: 99% confidence
• Finding: Tainted data flows into cmd and is executed by subprocess.run with shell=True, creating a direct command-injection path. Since artifact names, rubric-derived gap text, or other external content can influence the command string, an attacker can craft inputs that execute unintended shell operations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly instructs use of shell commands and persistent file writes (`report.md`, `reflect_log.json`, `learned_patterns.json`) but declares no permissions. This creates a transparency and policy-enforcement gap: an agent or platform may authorize the skill under a lower-trust profile while it still performs filesystem and command execution actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose is self-reflection and refinement, but the documentation also adds long-term memory, persistent user preference storage, error tracking, and even writing experience back into `SKILL.md`. That mismatch can mislead users and calling agents about the true data collection and self-modifying behavior, increasing the risk of unauthorized profiling or prompt-surface tampering.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This section expands a bounded reflection tool into a persistent learning and self-modifying system that stores experience and may rewrite its own skill documentation. Self-modification and durable profiling enlarge the attack surface and can let untrusted or low-quality runtime inputs influence future behavior across sessions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Persistent storage of user preferences and long-term usage history is not necessary for the core function of evaluating and refining an artifact. Unnecessary retention increases privacy risk, creates cross-session profiling, and can expose sensitive workflow information if the local memory file is read or reused by other processes.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The module persists operational history, error notes, and preferences to disk in a reusable file and is explicitly designed so any skill can call it. Because the target directory is caller-controlled, this creates cross-skill state mutation and retention beyond a narrow in-memory self-reflection loop, increasing privacy and integrity risk if notes or preferences contain sensitive data or if other skills consume the file unexpectedly.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: resolve_skill_dir accepts arbitrary directory paths or arbitrary names under ~/.workbuddy/skills, and later write operations create or overwrite learned_patterns.json in that location. This allows one skill invocation to write preference and activity data into another skill's directory or an attacker-chosen path, violating separation between skills and potentially tampering with files in writable locations.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill is described as a self-reflection/evaluation engine, but loop mode can execute arbitrary external shell commands through --refine-cmd. That materially expands the capability from analysis into general code execution, which is especially dangerous in agent settings where tools may be invoked on partially trusted inputs.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill describes storing user preferences, error history, and usage data in a local file without any user-facing privacy notice or consent mechanism. Silent persistence of behavioral data can surprise users, violate least-expectation principles, and enable unintended collection of sensitive information embedded in notes or error fields.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script silently writes learned_patterns.json containing user preferences, notes, error labels, and operation history without notice or consent. In the context of a self-reflection skill, these fields may capture sensitive prompts, workflow details, or personal preferences, creating an avoidable privacy leak on local disk.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script executes arbitrary shell commands via --refine-cmd without an explicit warning, confirmation step, or safety guard. In an agent skill context, that increases the chance operators treat the feature as routine text refinement rather than privileged command execution, leading to accidental compromise.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The instructions explicitly direct the skill to retain and reuse user preferences across future runs in `learned_patterns.json`. Cross-run memory can be exploited to build profiles, leak prior-session context into later tasks, or poison future behavior if malicious or sensitive content is recorded and then reused.

Unvalidated Output Injection

High

• Category: Output Handling

Content

# 自动整改：把本轮缺口作为上下文交给 refine 命令，产出下一版产物
                gap_txt = "; ".join(g["rectify"] for g in res["gaps"])
                cmd = a.refine_cmd.replace("{artifact}", cur).replace("{gaps}", gap_txt)
                r = subprocess.run(cmd, shell=True, capture_output=True, text=True)
                nxt = (r.stdout or "").strip().splitlines()
                nxt = nxt[-1] if nxt else ""
                if nxt and os.path.exists(nxt):

• Confidence: 96% confidence
• Finding: The command output is trusted to determine the next artifact path by taking the last stdout line and using it as a file path if it exists. Combined with arbitrary shell execution, this lets a malicious refine command steer the loop to attacker-chosen files, potentially causing unexpected reads, evaluations, or workflow manipulation.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 自动整改：把本轮缺口作为上下文交给 refine 命令，产出下一版产物
                gap_txt = "; ".join(g["rectify"] for g in res["gaps"])
                cmd = a.refine_cmd.replace("{artifact}", cur).replace("{gaps}", gap_txt)
                r = subprocess.run(cmd, shell=True, capture_output=True, text=True)
                nxt = (r.stdout or "").strip().splitlines()
                nxt = nxt[-1] if nxt else ""
                if nxt and os.path.exists(nxt):

• Confidence: 98% confidence
• Finding: The tool interface allows callers to abuse --refine-cmd as a general shell-execution primitive unrelated to the nominal task of reflection. In agent ecosystems, such parameter abuse can be chained to run arbitrary programs, exfiltrate data, or alter local state under the guise of iterative refinement.

Static analysis

No suspicious patterns detected.