claude-reflect

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes standard system utilities like jq, grep, cat, and ls via the Bash tool to manage its local queue, search session logs for corrections, and identify project directories. These operations are confined to the user's home directory (~/.claude/) and the current project directory.
  • [DYNAMIC_CONTEXT_INJECTION]: The commands/reflect.md file uses the dynamic context injection syntax (!command) to retrieve the current working directory and the contents of the local learnings queue when the command is initialized.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from user prompts and historical session logs to identify potential corrections. This surface is mitigated by a mandatory human-in-the-loop review process.
  • Ingestion points: Data is read from the local ~/.claude/learnings-queue.json file (populated by hooks) and from .jsonl session files in ~/.claude/projects/.
  • Boundary markers: While explicit delimiters are not used in the storage phase, the extracted content is re-processed by the agent into structured markdown bullets.
  • Capability inventory: The skill has the ability to write and edit files (CLAUDE.md, AGENTS.md) and execute bash commands.
  • Sanitization: The skill requires explicit human confirmation via AskUserQuestion before applying any extracted learnings to the file system, and the agent is instructed to filter and rephrase raw text into imperative instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:46 AM