Self-Refine Reflection

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:27 AM UTC
• Version: 2.0.1

Overview

This skill is not malicious, but it broadly changes agent behavior and can save reflection notes across sessions without clear consent or retention controls.

Install only if you want an agent-wide self-review layer and are comfortable with it writing persistent reflection notes. For sensitive work, disable or remove the memory/reflections.md behavior, review stored notes periodically, and avoid enabling it globally across projects unless that persistence is acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (28)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · BENCHMARK.md (reported line 137)May include surrounding context.

md

> POST /tasks — Create a task
> GET /tasks/:id — Get a task
> PUT /tasks/:id — Update a task
> DELETE /tasks/:id — Delete a task
> ```
> You should also add authentication and validation. Use Express.js with middleware for auth. Store tasks in a database like PostgreSQL. Add pagination for the list endpoint.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · BENCHMARK.md (reported line 149)May include surrounding context.

md

> POST /tasks — Create a task
> GET /tasks/:id — Get a task
> PUT /tasks/:id — Update a task
> DELETE /tasks/:id — Delete a task
> ```
> You should also add authentication and validation. Use Express.js with middleware for auth. Store tasks in a database like PostgreSQL. Add pagination for the list endpoint.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · BENCHMARK.md (reported line 820)May include surrounding context.

md

> 
> **Tier 3 — Before launch:**
> - `npm audit` in CI — fail on high/critical CVEs
> - JWT rotation strategy (short-lived access tokens + refresh tokens)
> - Structured logging (pino/winston) with request IDs for tracing
> - Health check endpoint (`GET /health`) for orchestrator

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · BENCHMARK.md (reported line 727)May include surrounding context.

md

>     }
> }
> ```
> **Key:** The `X-Forwarded-*` headers let your Node app know the real client IP and protocol. Without them, `req.ip` is `127.0.0.1`. SSL via certbot: `sudo certbot --nginx -d example.com`.

Scores: LC=8, FA=8, RC=8, CO=7, AC=8, IC=7 → Weighted: 7.70  
**Delta: +31.6%**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · BENCHMARK.md (reported line 793)May include surrounding context.

md

> - Enable CORS properly
> - Use prepared statements for SQL
> - Set up logging and monitoring
> - Don't run as root

Scores: LC=6, FA=7, RC=6, CO=5, AC=6, IC=6 → Weighted: 6.05

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instruction that the skill 'activates automatically before delivering final responses' is overly broad and applies to essentially all interactions without any scoping, trust boundary, or user-consent constraints. This creates a prompt-injection and policy-bypass risk because any risky or compromised behavior in the referenced skill would be invoked globally, increasing blast radius across all user queries.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · CLAUDE.md (reported line 5)May include surrounding context.

md

This project includes the Self-Refine Reflection Skill.

Read and follow `skills/self-refine-skill/SKILL.md` before responding to user queries.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · GEMINI.md (reported line 5)May include surrounding context.

md

This project includes the Self-Refine Reflection Skill.

Read and follow `skills/self-refine-skill/SKILL.md` before responding to user queries.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 184)May include surrounding context.

md

This project includes the Self-Refine Reflection Skill.

Read and follow `skills/self-refine-skill/SKILL.md` before responding to user queries.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 197)May include surrounding context.

md

This project includes the Self-Refine Reflection Skill.

Read and follow `skills/self-refine-skill/SKILL.md` before responding to user queries.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 208)May include surrounding context.

md

This project includes the Self-Refine Reflection Skill.

Read and follow `skills/self-refine-skill/SKILL.md` before responding to user queries.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 219)May include surrounding context.

md

This project includes the Self-Refine Reflection Skill.

Read and follow `skills/self-refine-skill/SKILL.md` before responding to user queries.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 229)May include surrounding context.

md

This project includes the Self-Refine Reflection Skill.

Read and follow `skills/self-refine-skill/SKILL.md` before responding to user queries.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 239)May include surrounding context.

md

This project includes the Self-Refine Reflection Skill.

Read and follow `skills/self-refine-skill/SKILL.md` before responding to user queries.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 255)May include surrounding context.

md

This project includes the Self-Refine Reflection Skill.

Read and follow `skills/self-refine-skill/SKILL.md` before responding to user queries.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 266)May include surrounding context.

md

This project includes the Self-Refine Reflection Skill.

Read and follow `skills/self-refine-skill/SKILL.md` before responding to user queries.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 283)May include surrounding context.

md

This project includes the Self-Refine Reflection Skill.

Read and follow `skills/self-refine-skill/SKILL.md` before responding to user queries.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README introduces cross-session learning that saves notes to memory, but it does not clearly warn users that prompts, outputs, or derived notes may be persisted across sessions. In an agent-skill context, undisclosed persistence can capture sensitive project data, credentials, or user content and retain it longer than expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The platform compatibility matrix advertises file-write memory support across multiple tools without an explicit warning that the skill may modify the filesystem. In coding-agent environments, silent file writes can expose sensitive data to disk, create hidden state, and surprise users who expected a stateless prompt-only enhancement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manual trigger phrases are broad enough to activate deeper reflection on common user wording such as 'think carefully' or 'make sure this is right,' which can be routine emphasis rather than an explicit opt-in. This creates ambiguous behavior control and can let a user unintentionally steer the agent into higher-cost or different processing modes, with possible reliability and policy-compliance side effects in constrained environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to write self-reflection notes to persistent memory across sessions without any user-facing notice, consent, retention limit, or sensitivity filter. Cross-session storage can capture derived information about user topics, mistakes, or interaction patterns, creating privacy, data governance, and prompt-injection persistence risks if later sessions read or act on those notes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The template explicitly instructs the agent to append content to memory/reflections.md, which is a persistent state modification. Because this is framed as an internal workflow instruction and includes no user-facing notice, approval gate, or constraints on what may be stored, it can cause silent retention of user-derived or sensitive information across sessions. In agent systems, hidden persistence increases privacy and integrity risk because later behavior may be influenced by data the user did not knowingly authorize to be stored.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.