reflect
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPERSISTENCECOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted conversation history to identify findings for persistence.\n
- Ingestion points: Full conversation history in the current context (SKILL.md).\n
- Boundary markers: None; the agent is instructed to re-read the entire context without specific delimiters or instructions to ignore embedded commands.\n
- Capability inventory: Local file writes (
CLAUDE.md,AGENTS.md,README.md), configuration updates (settings.json), and network/git operations (commit,push, PR creation).\n - Sanitization: Relies on human-in-the-loop review through
AskUserQuestionand internal "confidence bars." No technical sanitization of content is defined.\n- [PERSISTENCE]: The skill creates cross-session behavioral triggers through the modification of memory files and the implementation of automated hooks insettings.json. These "hooks" allow the agent to automate future responses based on current session outcomes.\n- [COMMAND_EXECUTION]: The skill utilizes shell commands to perform git operations (commit,push) and create pull requests. While standard for development workflows, this involves agent-driven system command execution based on processed conversation data.
Audit Metadata