reflect
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill scans the current conversation history for learning 'candidates' (corrections, decisions, friction) to document. This input is potentially untrusted as it comes from the conversation stream.
- Ingestion points: Processed conversation history is used to determine what content is written to disk (SKILL.md).
- Boundary markers: The instructions do not define specific delimiters for the conversation content, but they provide strict filtering criteria (durability, specificity) to validate candidates.
- Capability inventory: The skill has the ability to read and write to the filesystem (vault/ directory, skills/ directory, repository instruction files) and execute git commits.
- Sanitization: The skill mandates a human-in-the-loop review process ('Present every proposal as one tick list and wait') before any changes are applied, effectively mitigating the risk of the agent autonomously writing malicious instructions into the workspace based on conversation input.
Audit Metadata