ClawHub
Back to skill

Security audit

Reflect Notes

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Reflect note-taking helper that uses a user-provided token to write notes and links, with limited disclosed read helpers for links, books, and graph metadata.

Install only if you are comfortable giving the skill a Reflect API token and having user-selected notes, links, highlights, and Reflect metadata handled through reflect.app. Treat the token as sensitive, and review or remove the links/books/graphs helper commands if you want a write-only note capture skill.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The manifest describes note appending and note creation, but the documented behavior also includes saving links and retrieving links/books/graphs. This mismatch weakens informed consent and can cause users or orchestrators to invoke a skill that exfiltrates or enumerates data beyond its stated purpose.

Credential Access

High
Category
Privilege Escalation
Content
#   reflect.sh links

# Configuration: Set these environment variables
# REFLECT_TOKEN    - Your Reflect API access token (required)
# REFLECT_GRAPH_ID - Your graph ID (required, find via /api/graphs endpoint)

# Check for required environment variables
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
#   reflect.sh links

# Configuration: Set these environment variables
# REFLECT_TOKEN    - Your Reflect API access token (required)
# REFLECT_GRAPH_ID - Your graph ID (required, find via /api/graphs endpoint)

# Check for required environment variables
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill documents shell-based network operations but does not declare any explicit tool scope or allowed-tools boundary. That makes the operational capability broader and less auditable, increasing the chance an agent invokes shell access unexpectedly for external API calls or secret handling.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The description omits link and book retrieval despite the body documenting those capabilities. Hidden or under-disclosed read functionality is security-relevant because it changes the data exposure profile of the skill.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill is described in broad terms like capturing thoughts, todos, or syncing information, without clear trigger constraints or approval boundaries. In an agent setting, broad invocation language can cause overuse on arbitrary user content and increase accidental transmission of sensitive data to the external service.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The documentation states the API is append-only and cannot read note contents, but later includes read operations for links/books and graph listing. Even if note contents remain unreadable, this wording can mislead reviewers into assuming the skill has no read capabilities at all.

External Transmission

Medium
Category
Data Exfiltration
Content
3. Set environment variables:
   ```bash
   export REFLECT_TOKEN="your-access-token"
   export REFLECT_GRAPH_ID="your-graph-id"  # Find via: curl -H "Authorization: Bearer $REFLECT_TOKEN" https://reflect.app/api/graphs
   ```

Or store in 1Password and update `scripts/reflect.sh` with your vault/item path.
Confidence
95% confidence
Finding
The skill sends data and bearer-token-authenticated requests to an external service over the network. External transmission is expected for this integration, but it is still security-sensitive because user content, URLs, highlights, and graph metadata may leave the local environment.

External Transmission

Medium
Category
Data Exfiltration
Content
if [[ -z "${REFLECT_GRAPH_ID:-}" ]]; then
  echo "Error: REFLECT_GRAPH_ID environment variable not set" >&2
  echo "Find your graph ID by running:" >&2
  echo "  curl -H \"Authorization: Bearer \$REFLECT_TOKEN\" https://reflect.app/api/graphs" >&2
  exit 1
fi
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill advertises note capture and daily-note creation, but the script also exposes broader data-enumeration functions for books and graphs. This scope expansion is dangerous because an agent or user trusting the manifest may unintentionally grant a tool the ability to read additional account metadata and content beyond what was disclosed.

Static analysis

No suspicious patterns detected.