Audit-Verlauf

claude-reflect is a documentation-only Claude Code plugin corpus (8 Markdown/text files, no executable scripts in scope). All 91 static findings were adjudicated as false positives: the `~/.claude/*` references are the plugin's own documented memory-hierarchy and queue storage, the two CRITICAL `rm -rf` hits are user-facing cache-clearing instructions scoped to a specific named plugin-cache subdirectory in the README troubleshooting section, the 'backtick execution' hits are Markdown inline-code/code-fence syntax, and the hardcoded URLs point to the project's own public repository. No prompt-injection, data-exfiltration, or business-logic-abuse intent was found.

All 72 static alerts are false positives after contextual review. Markdown formatting caused command alerts, GitHub links are documentation, and cache deletion targets only plugin-specific directories. Approved text can still alter persistent agent instructions, while correction capture and history scans may retain sensitive session content locally.

The static command, network, and reconnaissance alerts are mostly markdown documentation false positives. The filesystem alerts are confirmed because the skill intentionally reads and writes Claude Code memory, rules, queues, settings, session history, and command files under hidden directories.

This skill intentionally reads and writes Claude Code memory files, queues user corrections, and can scan local session history under the user home directory. Most confirmed findings are privacy, local persistence, and external CLI analysis risks tied to the core feature, while documentation, tests, /dev/null redirects, and the reviewed JPEG asset are false positives. No evidence found of network exfiltration code or prompt-injection text that tries to bypass this audit.

Static analysis reported a critical heuristic because the repository combines scripts, shell examples, home-directory file access, URLs, and secret-related terms. Manual review found no evidence of malicious C2, credential exfiltration, or prompt-injection text in the skill files, but confirmed a real elevated-risk design: hooks capture local prompts, /reflect can scan session history, and approved learnings are written to assistant guidance files. Publish with a clear privacy and file-modification warning.

This is a legitimate self-learning system with no malicious intent. All static findings are false positives: shell commands are documentation examples, hidden file access targets the standard ~/.claude/ directory for Claude configuration, and credential references are guidance documentation, not actual access. The critical heuristic alert incorrectly flagged local file operations as dangerous.

This is a legitimate self-learning system with no malicious intent. All static findings are false positives: shell commands are documentation examples, hidden file access targets the standard ~/.claude/ directory for Claude configuration, and credential references are guidance documentation, not actual access. The critical heuristic alert incorrectly flagged local file operations as dangerous.

Legitimate self-learning system with minimal risk profile. All code execution is self-contained and serves the stated purpose of capturing user corrections. No network calls, no credential access, no data exfiltration.

Legitimate self-learning system with minimal risk profile. All code execution is self-contained and serves the stated purpose of capturing user corrections. No network calls, no credential access, no data exfiltration.

Legitimate self-learning system with minimal risk profile. All code execution is self-contained and serves the stated purpose of capturing user corrections. No network calls, no credential access, no data exfiltration.