Security audit

Reflect Notes

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Reflect helper for adding notes and links and listing related Reflect resources, with no evidence of hidden, destructive, or unrelated behavior.

Install only if you want an agent to write notes and links to your Reflect account and, when asked, list saved links, books, or graph metadata. Keep REFLECT_TOKEN private, use the narrowest token Reflect supports, and revoke it if you stop using the skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 81% confidence
Finding: The skill documents and encourages shell execution via curl and helper scripts, but no corresponding permissions are declared. That creates a transparency and policy gap: an agent or reviewer may underestimate that the skill can make authenticated external network calls and access local environment secrets such as REFLECT_TOKEN. In this context, the shell capability is especially relevant because it can exfiltrate or misuse the bearer token against the Reflect API.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The declared purpose says the skill is for appending notes and creating notes, but the documented behavior also includes creating links and retrieving links/books/graphs. This mismatch weakens informed consent and review: operators may grant or invoke the skill expecting write-only note capture, while it also enables broader data access and account enumeration through authenticated API calls. Because the skill uses a bearer token, these extra read/list capabilities expand the blast radius if the skill is misused or prompted unexpectedly.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The manifest description omits retrieval features for links/books and related account-discovery behavior, so users and security controls may treat the skill as a limited write-only note sink when it is not. Hidden or under-disclosed read capabilities are dangerous because they can enable unintended data exposure, metadata harvesting, or token-powered reconnaissance against the user's Reflect graph.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script exposes additional data-retrieval capabilities (`links`, `books`, and `graphs`) that go beyond the declared skill purpose of appending daily notes and creating notes. In an agent setting, this scope expansion increases the chance of unnecessary data access and makes it easier for a caller to enumerate private account metadata without the user clearly expecting that behavior.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Access to `/books` and `/graphs` is not necessary for the stated core workflow and enables retrieval of potentially sensitive account and knowledge-graph metadata. Even if intended as convenience helpers, these endpoints broaden the accessible data surface and can facilitate unwanted enumeration of user resources.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.