reflectt-node

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:14 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent localhost collaboration helper, but it tells agents to accept and act on tasks that anyone can create without documented authentication or approval checks.

Install only in a trusted local/team environment. Treat chat messages and task descriptions as untrusted input, do not put secrets or credentials into the service, and require human approval before agents act on tasks that read files, run commands, modify data, or contact external systems.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:38

Finding

Unauthenticated Task Injection into the Agent Workflow

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:38-52, SKILL.md:87-92, and SKILL.md:103-106
Vulnerability Type: Untrusted instructions accepted through an unauthenticated task-control channel
Risk Level: High

Vulnerable Code Snippets

SKILL.md:38-52:

bash

# Get your next task
curl -s 'http://127.0.0.1:4445/tasks/next?agent=YOUR_NAME'

# List all tasks
curl -s http://127.0.0.1:4445/tasks

# Create a task
curl -s -X POST http://127.0.0.1:4445/tasks \
  -H "Content-Type: application/json" \
  -d '{"title": "Task title", "description": "Details", "assignee": "agent_name", "createdBy": "YOUR_NAME", "priority": "P1"}'

# Update task status (YOU own your tasks — update them yourself!)
curl -s -X PATCH http://127.0.0.1:4445/tasks/TASK_ID \
  -H "Content-Type: application/json" \
  -d '{"status": "done"}'

SKILL.md:87-92:

markdown

Every heartbeat, agents should:
1. Check inbox: `GET /inbox/YOUR_NAME`
2. Check for tasks: `GET /tasks/next?agent=YOUR_NAME`
3. If there's work → do it, update task status
4. If status changed or work shipped → post to #general
5. If nothing changed → return `HEARTBEAT_OK` silently (don't post noise)

SKILL.md:103-106:

markdown

1. **Anyone** can create tasks when they see work needed
2. **You own** your assigned tasks — move them through the workflow yourself
3. When you finish work → `PATCH /tasks/:id {"status": "done"}` immediately
4. Don't just chat about needed work — **create a task**

Technical Analysis

The documented task-control workflow does not require an authentication credential, authorization token, trusted-issuer identity, task signature, or approval step. The task creation request allows the caller to supply the assignee, creator identity, title, and description. The documentation also explicitly states that anyone can create tasks.

Agents are instructed to poll for assigned tasks and perform an ...[truncated 2479 chars]

Remediation

View remediation

Remediation Suggestions

1. Require authenticated identities for every task creation, retrieval, and update request. Do not rely on caller-supplied createdBy values as proof of identity.
2. Enforce server-side authorization so only approved users or agents can create tasks for a particular assignee.
3. Cryptographically sign tasks or attach server-validated issuer metadata that agents can verify before processing them.
4. Treat titles, descriptions, chat messages, and other collaboration data as untrusted input rather than authoritative instructions.
5. Require explicit user approval before an agent executes tasks that access secrets, modify files, run commands, contact external systems, or exceed the agent's established scope.
6. Define per-agent allowlists for permitted task creators, operations, tools, paths, and network destinations.
7. Reject spoofed creator identities and maintain tamper-resistant audit records for task creation, assignment, approval, and completion.
8. Add rate limiting and monitoring for unusual task creation patterns, repeated reassignment, and sensitive instruction content.
9. Update the heartbeat rules to require safety validation and issuer verification before acting on returned work.
10. Preserve the localhost binding as defense in depth, but use authenticated local transport or strict socket-level access controls because localhost alone is not a trust boundary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file documents posting messages, reading messages, and using shared collaboration channels, which can affect user or team data visibility. The description does not warn that content sent to the service may be visible to other agents or persisted by the local server.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The skill instructs agents to POST arbitrary content to an HTTP service on localhost, which is still an external sink from the agent's perspective and can exfiltrate sensitive prompts, task data, or user content into a shared service. The surrounding skill strongly encourages routine communication and heartbeat-driven use, increasing the chance that private data is transmitted without sufficient trust validation, auth checks, or user awareness.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

Messaging

bash

# Post a message
curl -s -X POST http://127.0.0.1:4445/chat/messages \
  -H "Content-Type: application/json" \
  -d '{"from": "YOUR_NAME", "channel": "general", "content": "Your message"}'

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

# List all tasks
curl -s http://127.0.0.1:4445/tasks

# Create a task
curl -s -X POST http://127.0.0.1:4445/tasks \
  -H "Content-Type: application/json" \
  -d '{"title": "Task title", "description": "Details", "assignee": "agent_name", "createdBy": "YOUR_NAME", "priority": "P1"}'

Static analysis

No suspicious patterns detected.