reflect
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes conversation transcripts (.jsonl files) which are treated as untrusted data sources. The skill implements strong defensive patterns:
- Ingestion points: Reads transcripts from various platform-specific directories (e.g.,
~/.claude/projects/,~/.cursor/rules/). - Boundary markers: All subagent prompts (
references/*.md) explicitly warn the agent to treat transcripts as untrusted and to ignore any instructions or directives embedded within them. - Capability inventory: The skill can read local files and suggest edits to other skills. It uses shell commands for file discovery.
- Sanitization: The workflow includes a synthesis step that cross-references multiple reviewer findings and enforces a mandatory 'human-in-the-loop' approval stage before any skill modifications are applied.
- [COMMAND_EXECUTION]: The skill uses local shell commands (
ls,head,2>/dev/null) to programmatically locate the most recent or relevant transcript file. These commands are used for file discovery within the active workspace and do not involve executing external or user-provided scripts.
Audit Metadata