Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward Reflect note-taking helper that uses a user-provided token to write notes and links, with limited disclosed read helpers for links, books, and graph metadata.
Install only if you are comfortable giving the skill a Reflect API token and having user-selected notes, links, highlights, and Reflect metadata handled through reflect.app. Treat the token as sensitive, and review or remove the links/books/graphs helper commands if you want a write-only note capture skill.
The manifest describes note appending and note creation, but the documented behavior also includes saving links and retrieving links/books/graphs. This mismatch weakens informed consent and can cause users or orchestrators to invoke a skill that exfiltrates or enumerates data beyond its stated purpose.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# reflect.sh links
# Configuration: Set these environment variables
# REFLECT_TOKEN - Your Reflect API access token (required)
# REFLECT_GRAPH_ID - Your graph ID (required, find via /api/graphs endpoint)
# Check for required environment variables
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# reflect.sh links
# Configuration: Set these environment variables
# REFLECT_TOKEN - Your Reflect API access token (required)
# REFLECT_GRAPH_ID - Your graph ID (required, find via /api/graphs endpoint)
# Check for required environment variables
The skill documents shell-based network operations but does not declare any explicit tool scope or allowed-tools boundary. That makes the operational capability broader and less auditable, increasing the chance an agent invokes shell access unexpectedly for external API calls or secret handling.
The description omits link and book retrieval despite the body documenting those capabilities. Hidden or under-disclosed read functionality is security-relevant because it changes the data exposure profile of the skill.
The skill is described in broad terms like capturing thoughts, todos, or syncing information, without clear trigger constraints or approval boundaries. In an agent setting, broad invocation language can cause overuse on arbitrary user content and increase accidental transmission of sensitive data to the external service.
The documentation states the API is append-only and cannot read note contents, but later includes read operations for links/books and graph listing. Even if note contents remain unreadable, this wording can mislead reviewers into assuming the skill has no read capabilities at all.
The skill sends data and bearer-token-authenticated requests to an external service over the network. External transmission is expected for this integration, but it is still security-sensitive because user content, URLs, highlights, and graph metadata may leave the local environment.
export REFLECT_TOKEN="your-access-token"
export REFLECT_GRAPH_ID="your-graph-id" # Find via: curl -H "Authorization: Bearer $REFLECT_TOKEN" https://reflect.app/api/graphs
Or store in 1Password and update scripts/reflect.sh with your vault/item path.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if [[ -z "${REFLECT_GRAPH_ID:-}" ]]; then
echo "Error: REFLECT_GRAPH_ID environment variable not set" >&2
echo "Find your graph ID by running:" >&2
echo " curl -H \"Authorization: Bearer \$REFLECT_TOKEN\" https://reflect.app/api/graphs" >&2
exit 1
fi
The skill advertises note capture and daily-note creation, but the script also exposes broader data-enumeration functions for books and graphs. This scope expansion is dangerous because an agent or user trusting the manifest may unintentionally grant a tool the ability to read additional account metadata and content beyond what was disclosed.
No suspicious patterns detected.