claude-reflect
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard system utilities like
jq,grep,cat, andlsvia the Bash tool to manage its local queue, search session logs for corrections, and identify project directories. These operations are confined to the user's home directory (~/.claude/) and the current project directory. - [DYNAMIC_CONTEXT_INJECTION]: The
commands/reflect.mdfile uses the dynamic context injection syntax (!command) to retrieve the current working directory and the contents of the local learnings queue when the command is initialized. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from user prompts and historical session logs to identify potential corrections. This surface is mitigated by a mandatory human-in-the-loop review process.
- Ingestion points: Data is read from the local
~/.claude/learnings-queue.jsonfile (populated by hooks) and from.jsonlsession files in~/.claude/projects/. - Boundary markers: While explicit delimiters are not used in the storage phase, the extracted content is re-processed by the agent into structured markdown bullets.
- Capability inventory: The skill has the ability to write and edit files (
CLAUDE.md,AGENTS.md) and execute bash commands. - Sanitization: The skill requires explicit human confirmation via
AskUserQuestionbefore applying any extracted learnings to the file system, and the agent is instructed to filter and rephrase raw text into imperative instructions.
Audit Metadata