reflect
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from session transcripts (.jsonl files) and existing GitHub issue bodies, creating a surface for indirect injection attacks.
- Ingestion points: Transcripts are read from ~/.claude/projects/ via the custom reflect scan tool. Existing issue data is fetched from GitHub using the gh issue list command.
- Boundary markers: The instructions for spawning reviewer sub-agents do not specify the use of delimiters or security instructions to isolate the ingested transcript digests from the sub-agent instructions.
- Capability inventory: The skill possesses the Agent tool for sub-agent spawning, Write for local reports, and Bash access to the GitHub CLI (gh issue, gh label) for external data transmission.
- Sanitization: While the reflect binary redacts secrets, it does not appear to sanitize transcripts for embedded natural language instructions that might influence agent reasoning.
- [DATA_EXFILTRATION]: The skill's primary function involves extracting information from sensitive local session logs and uploading findings to external GitHub repositories.
- Evidence: The SKILL.md and references/issue-format.md files detail the systematic export of session-derived data to GitHub. This risk is moderated by a mandatory user confirmation step before any issues are filed.
Audit Metadata