reflect
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes session logs ($PI_SESSION_FILE) which contain untrusted content from previous interactions and tool outputs. This data is analyzed by a subagent to propose changes to project configuration files (AGENTS.md, CONTEXT.md) and skill definitions. Although the skill includes instructions to ignore embedded commands and requires user confirmation for non-trivial edits, malicious data in the logs could potentially influence the agent's behavior.
- Ingestion points: Reads $PI_SESSION_FILE in step 2.
- Boundary markers: Uses Markdown headers in the digest but lacks strict isolation between instructions and data.
- Capability inventory: Modifies project-level rules and skill files.
- Sanitization: Implements regex-based redaction of common API tokens and secrets.
- [DYNAMIC_EXECUTION]: The skill generates a local Node.js script (/tmp/reflect-digest.mjs) from a template and executes it to generate session digests. While the script logic is visible and intended for parsing, the pattern of creating and running scripts at runtime is a notable security surface.
- [COMMAND_EXECUTION]: The skill invokes the Node.js runtime to execute the generated processing script on the local system.
Audit Metadata