Dieser Bericht ist nicht in der angeforderten Sprache verfügbar. Stattdessen wird der maßgebliche englische Bericht angezeigt.

Versionierte Sicherheitsbewertung

Berichts-ID: SA-DE75EA47

7/5/2026, 4:52:41 AM

claude-reflect Sicherheitsbewertung v7

Zertifizierungsbericht zur Skill-Sicherheit

Audit-Verlauf
Auditmodell: codex Historischer Bericht
Skillname
claude-reflect
Version
v7
Betreuer
BayramAnnakov
Quelle
github.com/BayramAnnakov/claude-reflect/tree/main/
Abdeckung
29 Gescannte Dateien · 5,827 Analysierte Zeilen
Richtlinienversion
Nicht verfügbar

Höchster bestätigter Schweregrad eines Befunds

Hoch

13 bestätigte Sicherheitsbefunde erfordern Aufmerksamkeit.

Installationskontext

Historische Nachweise

Dieser Bericht beschreibt möglicherweise nicht das derzeit installierbare Artefakt. Öffnen Sie die aktuelle Skill-Seite für Installationshinweise.

Aktuelle Skill-Seite öffnen

Dieser Bericht blockiert oder autorisiert weder das Manifest noch die ZIP-Datei.

This skill intentionally reads and writes Claude Code memory files, queues user corrections, and can scan local session history under the user home directory. Most confirmed findings are privacy, local persistence, and external CLI analysis risks tied to the core feature, while documentation, tests, /dev/null redirects, and the reviewed JPEG asset are false positives. No evidence found of network exfiltration code or prompt-injection text that tries to bypass this audit.

Position melden

Historischer Bericht

Öffnen Sie den Auditverlauf, bevor Sie diesen Bericht zur Installation verwenden.

Audit-Nachweis

Nicht bescheinigungsfähig

Die erforderliche unveränderliche Bindung ist unvollständig.

Menschliche Überprüfung

Nicht überprüft

Für diesen Bericht ist keine menschliche Überprüfung verzeichnet.

Abdeckung

29 Gescannte Dateien · 5,827 Analysierte Zeilen

100 Elemente zur Überprüfung angezeigt

Einschränkungen

Dieser Bericht beansprucht keine Laufzeit- oder Sandbox-Ausführung und beweist nicht das Fehlen von Nebenwirkungen.

Beweiskette

Folgen Sie den Nachweisen von der Quellenbindung bis zum Installationsvertrag. Verfügbare Nachweise unterstützen die Überprüfung; sie sind keine Sicherheitsgarantie.

  1. Quelle

    Bindung nicht verfügbar

  2. Artefakt

    Identität unvollständig

  3. Prüfung

    Vollständig

  4. Installationsvertrag

    Manifest zur Überprüfung öffnen

    Manifest öffnen

Beobachtete Funktionen

„Beobachtet“ bedeutet, dass dieser Bericht unterstützende Nachweise erfasst hat. Nicht erfasst bedeutet nicht, dass eine Fähigkeit nicht vorhanden ist.

Enthält Skripte

Kann mit dem Skill enthaltenen Code ausführen.

An 5 Nachweisstellen beobachtet

Netzwerkzugriff

Kann eine Verbindung zu externen Diensten herstellen.

An 8 Nachweisstellen beobachtet

Dateisystemzugriff

Kann lokale Dateien lesen oder schreiben.

An 75 Nachweisstellen beobachtet

Umgebungsvariablen

Kann Werte aus der Prozessumgebung lesen.

An 4 Nachweisstellen beobachtet

Externe Befehle

Kann Befehle oder Programme außerhalb des Skills aufrufen.

An 71 Nachweisstellen beobachtet

Elemente der Fähigkeitsprüfung (87)
Hoch
commands/reflect.md:17
Hidden file in home directory
- Global CLAUDE.md: @~/.claude/CLAUDE.md
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:18
Hidden file in home directory
- Learnings queue: !`cat ~/.claude/learnings-queue.json 2>/dev/null || echo "[]"`
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:29
Hidden file in home directory
| **Claude Code** | `~/.claude/CLAUDE.md`, `./CLAUDE.md` | Markdown | Always enabled |
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:35
Hidden file in home directory
~/.claude/CLAUDE.md
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:63
Hidden file in home directory
2. "Load learnings queue from ~/.claude/learnings-queue.json"
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:86
Hidden file in home directory
{"content": "Load learnings queue", "status": "pending", "activeForm": "Loading queue from ~/.claude
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:112
Hidden file in home directory
echo "✓ ~/.claude/CLAUDE.md (Claude Code - always enabled)"
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:123
Hidden file in home directory
✓ ~/.claude/CLAUDE.md (Claude Code - always enabled)
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:142
Hidden file in home directory
cat ~/.claude/learnings-queue.json | jq -r '.[] | "\(.timestamp) | conf:\(.confidence // 0.5) | deca
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:173
Hidden file in home directory
cat ~/.claude/CLAUDE.md
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:240
Hidden file in home directory
ls ~/.claude/projects/ | grep -i "$(basename "$(pwd)")"
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:245
Hidden file in home directory
test -f ~/.claude/projects/PROJECT_FOLDER/.reflect-initialized && echo "initialized" || echo "first-
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:291
Hidden file in home directory
ls ~/.claude/projects/ | grep -i "$(basename $(pwd))"
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:297
Hidden file in home directory
ls ~/.claude/projects/ | grep -i "$(basename $(pwd) | tr '_' '-')"
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:302
Hidden file in home directory
ls ~/.claude/projects/[PROJECT_FOLDER]/*.jsonl
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:338
Hidden file in home directory
- Session files: `~/.claude/projects/[PROJECT_FOLDER]/*.jsonl`
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:522
Hidden file in home directory
- Read the queue from `~/.claude/learnings-queue.json`
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:598
Hidden file in home directory
ls -lt ~/.claude/projects/ | grep -i "$(basename $(pwd))"
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:603
Hidden file in home directory
ls -lt ~/.claude/projects/[PROJECT_FOLDER]/*.jsonl | head -5
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:751
Hidden file in home directory
grep -n -i "keyword" ~/.claude/CLAUDE.md
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:893
Hidden file in home directory
Global CLAUDE.md (~/.claude/CLAUDE.md):
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:963
Hidden file in home directory
echo "[]" > ~/.claude/learnings-queue.json
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:972
Hidden file in home directory
✓ ~/.claude/CLAUDE.md [N] entries
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:986
Hidden file in home directory
touch ~/.claude/projects/PROJECT_FOLDER/.reflect-initialized
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/reflect.md:509
Database connection strings
→ Proposed: "Check DATABASE_URL in .env for PostgreSQL connection"
The workflow extracts environment-related tool errors and proposes learnings about .env, DATABASE_URL, API keys, or service URLs. This can persist sensitive configuration context if the user approves unsafe text.
Hoch
commands/skip-reflect.md:7
Hidden file in home directory
- Queue count: !`jq 'length' ~/.claude/learnings-queue.json 2>/dev/null || echo 0`
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/skip-reflect.md:23
Hidden file in home directory
echo "[]" > ~/.claude/learnings-queue.json
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/view-queue.md:7
Hidden file in home directory
- Queue file: `~/.claude/learnings-queue.json`
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
commands/view-queue.md:47
Hidden file in home directory
cat ~/.claude/learnings-queue.json 2>/dev/null || echo "[]"
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Hoch
scripts/lib/reflect_utils.py:388
Database connection strings
r"(\w+_URL|DATABASE_URL|API_KEY|SECRET).*undefined|not set|is not defined",
The utility classifies tool errors using patterns for DATABASE_URL, API_KEY, SECRET, Supabase, Postgres, and Redis configuration. Aggregating those errors can capture sensitive project configuration context.
Hoch
scripts/lib/reflect_utils.py:396
Database connection strings
"Check DATABASE_URL in .env for PostgreSQL connection"),
The utility classifies tool errors using patterns for DATABASE_URL, API_KEY, SECRET, Supabase, Postgres, and Redis configuration. Aggregating those errors can capture sensitive project configuration context.
Hoch
scripts/lib/reflect_utils.py:399
Database connection strings
"Check REDIS_URL in .env for Redis connection"),
The utility classifies tool errors using patterns for DATABASE_URL, API_KEY, SECRET, Supabase, Postgres, and Redis configuration. Aggregating those errors can capture sensitive project configuration context.
Hoch
scripts/lib/reflect_utils.py:388
Generic API/secret keys
r"(\w+_URL|DATABASE_URL|API_KEY|SECRET).*undefined|not set|is not defined",
The utility classifies tool errors using patterns for DATABASE_URL, API_KEY, SECRET, Supabase, Postgres, and Redis configuration. Aggregating those errors can capture sensitive project configuration context.
Hoch
scripts/lib/semantic_detector.py:76
Python subprocess.run
result = subprocess.run(
The code invokes the external Claude CLI with captured user/session text as prompt input. That is real external command execution and may transmit sensitive content through the configured Claude CLI.
Hoch
scripts/lib/semantic_detector.py:308
Python subprocess.run
result = subprocess.run(
The code invokes the external Claude CLI with captured user/session text as prompt input. That is real external command execution and may transmit sensitive content through the configured Claude CLI.
Mittel
commands/reflect.md:240
Shell command substitution
ls ~/.claude/projects/ | grep -i "$(basename "$(pwd)")"
This command prompt instructs Bash execution with shell expansion while locating project/session state. The arguments are mostly hardcoded, but the command still runs against local user context.
Mittel
commands/reflect.md:291
Shell command substitution
ls ~/.claude/projects/ | grep -i "$(basename $(pwd))"
This command prompt instructs Bash execution with shell expansion while locating project/session state. The arguments are mostly hardcoded, but the command still runs against local user context.
Mittel
commands/reflect.md:297
Shell command substitution
ls ~/.claude/projects/ | grep -i "$(basename $(pwd) | tr '_' '-')"
This command prompt instructs Bash execution with shell expansion while locating project/session state. The arguments are mostly hardcoded, but the command still runs against local user context.
Mittel
commands/reflect.md:474
Shell command substitution
python scripts/extract_tool_errors.py --project "$(pwd)" --min-count 2 --json
This command prompt instructs Bash execution with shell expansion while locating project/session state. The arguments are mostly hardcoded, but the command still runs against local user context.
Mittel
commands/reflect.md:598
Shell command substitution
ls -lt ~/.claude/projects/ | grep -i "$(basename $(pwd))"
This command prompt instructs Bash execution with shell expansion while locating project/session state. The arguments are mostly hardcoded, but the command still runs against local user context.
Mittel
commands/reflect.md:17
Hidden file access
- Global CLAUDE.md: @~/.claude/CLAUDE.md
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:18
Hidden file access
- Learnings queue: !`cat ~/.claude/learnings-queue.json 2>/dev/null || echo "[]"`
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:29
Hidden file access
| **Claude Code** | `~/.claude/CLAUDE.md`, `./CLAUDE.md` | Markdown | Always enabled |
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:35
Hidden file access
~/.claude/CLAUDE.md
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:63
Hidden file access
2. "Load learnings queue from ~/.claude/learnings-queue.json"
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:86
Hidden file access
{"content": "Load learnings queue", "status": "pending", "activeForm": "Loading queue from ~/.claude
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:112
Hidden file access
echo "✓ ~/.claude/CLAUDE.md (Claude Code - always enabled)"
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:123
Hidden file access
✓ ~/.claude/CLAUDE.md (Claude Code - always enabled)
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:142
Hidden file access
cat ~/.claude/learnings-queue.json | jq -r '.[] | "\(.timestamp) | conf:\(.confidence // 0.5) | deca
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:173
Hidden file access
cat ~/.claude/CLAUDE.md
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:240
Hidden file access
ls ~/.claude/projects/ | grep -i "$(basename "$(pwd)")"
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:245
Hidden file access
test -f ~/.claude/projects/PROJECT_FOLDER/.reflect-initialized && echo "initialized" || echo "first-
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:291
Hidden file access
ls ~/.claude/projects/ | grep -i "$(basename $(pwd))"
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:297
Hidden file access
ls ~/.claude/projects/ | grep -i "$(basename $(pwd) | tr '_' '-')"
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:302
Hidden file access
ls ~/.claude/projects/[PROJECT_FOLDER]/*.jsonl
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:338
Hidden file access
- Session files: `~/.claude/projects/[PROJECT_FOLDER]/*.jsonl`
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:522
Hidden file access
- Read the queue from `~/.claude/learnings-queue.json`
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:598
Hidden file access
ls -lt ~/.claude/projects/ | grep -i "$(basename $(pwd))"
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:603
Hidden file access
ls -lt ~/.claude/projects/[PROJECT_FOLDER]/*.jsonl | head -5
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:751
Hidden file access
grep -n -i "keyword" ~/.claude/CLAUDE.md
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:893
Hidden file access
Global CLAUDE.md (~/.claude/CLAUDE.md):
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:963
Hidden file access
echo "[]" > ~/.claude/learnings-queue.json
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:972
Hidden file access
✓ ~/.claude/CLAUDE.md [N] entries
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/reflect.md:986
Hidden file access
touch ~/.claude/projects/PROJECT_FOLDER/.reflect-initialized
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/skip-reflect.md:7
Hidden file access
- Queue count: !`jq 'length' ~/.claude/learnings-queue.json 2>/dev/null || echo 0`
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/skip-reflect.md:23
Hidden file access
echo "[]" > ~/.claude/learnings-queue.json
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/view-queue.md:7
Hidden file access
- Queue file: `~/.claude/learnings-queue.json`
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
commands/view-queue.md:47
Hidden file access
cat ~/.claude/learnings-queue.json 2>/dev/null || echo "[]"
This command prompt directs Claude Code to read or write hidden Claude memory, queue, or session files under the user home directory. That is intentional behavior, but it is a real privacy and local file integrity risk.
Mittel
scripts/legacy/capture-learning.sh:9
Shell command substitution
INPUT="$(cat -)"
This legacy shell script invokes local shell commands and parses hook input. It is not clearly malicious, but it is executable script behavior that can affect local Claude Reflect state.
Mittel
scripts/legacy/capture-learning.sh:13
Shell command substitution
PROMPT="$(echo "$INPUT" | jq -r '.prompt // .message // .text // empty' 2>/dev/null)"
This legacy shell script invokes local shell commands and parses hook input. It is not clearly malicious, but it is executable script behavior that can affect local Claude Reflect state.
Mittel
scripts/legacy/capture-learning.sh:17
Shell command substitution
PROJECT="$(pwd)"
This legacy shell script invokes local shell commands and parses hook input. It is not clearly malicious, but it is executable script behavior that can affect local Claude Reflect state.
Mittel
scripts/legacy/capture-learning.sh:22
Shell command substitution
TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
This legacy shell script invokes local shell commands and parses hook input. It is not clearly malicious, but it is executable script behavior that can affect local Claude Reflect state.
Mittel
scripts/legacy/capture-learning.sh:149
Shell command substitution
MATCHED_PATTERNS=$(echo "$MATCHED_PATTERNS" | sed 's/^ *//')
This legacy shell script invokes local shell commands and parses hook input. It is not clearly malicious, but it is executable script behavior that can affect local Claude Reflect state.
Mittel
scripts/legacy/capture-learning.sh:1
Unix shell invocation
#!/bin/bash
This legacy shell script invokes local shell commands and parses hook input. It is not clearly malicious, but it is executable script behavior that can affect local Claude Reflect state.
Mittel
scripts/legacy/capture-learning.sh:6
Hidden file access
QUEUE_FILE="$HOME/.claude/learnings-queue.json"
This legacy shell script accesses the hidden Claude Reflect queue or backup directory under the user home directory. That hidden-file access is real local persistence behavior.
Mittel
scripts/legacy/check-learnings.sh:9
Shell command substitution
COUNT=$(jq 'length' "$QUEUE_FILE" 2>/dev/null || echo 0)
This legacy shell script invokes local shell commands and parses hook input. It is not clearly malicious, but it is executable script behavior that can affect local Claude Reflect state.
Mittel
scripts/legacy/check-learnings.sh:15
Shell command substitution
BACKUP_FILE="$BACKUP_DIR/pre-compact-$(date +%Y%m%d-%H%M%S).json"
This legacy shell script invokes local shell commands and parses hook input. It is not clearly malicious, but it is executable script behavior that can affect local Claude Reflect state.
Mittel
scripts/legacy/check-learnings.sh:1
Unix shell invocation
#!/bin/bash
This legacy shell script invokes local shell commands and parses hook input. It is not clearly malicious, but it is executable script behavior that can affect local Claude Reflect state.
Mittel
scripts/legacy/check-learnings.sh:5
Hidden file access
QUEUE_FILE="$HOME/.claude/learnings-queue.json"
This legacy shell script accesses the hidden Claude Reflect queue or backup directory under the user home directory. That hidden-file access is real local persistence behavior.
Mittel
scripts/legacy/check-learnings.sh:6
Hidden file access
BACKUP_DIR="$HOME/.claude/learnings-backups"
This legacy shell script accesses the hidden Claude Reflect queue or backup directory under the user home directory. That hidden-file access is real local persistence behavior.
Mittel
scripts/legacy/extract-session-learnings.sh:1
Unix shell invocation
#!/bin/bash
This legacy shell script invokes local shell commands and parses hook input. It is not clearly malicious, but it is executable script behavior that can affect local Claude Reflect state.
Mittel
scripts/legacy/extract-tool-rejections.sh:1
Unix shell invocation
#!/bin/bash
This legacy shell script invokes local shell commands and parses hook input. It is not clearly malicious, but it is executable script behavior that can affect local Claude Reflect state.
Mittel
scripts/legacy/post-commit-reminder.sh:8
Shell command substitution
INPUT="$(cat -)"
This legacy shell script invokes local shell commands and parses hook input. It is not clearly malicious, but it is executable script behavior that can affect local Claude Reflect state.
Mittel
scripts/legacy/post-commit-reminder.sh:14
Shell command substitution
COMMAND="$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)"
This legacy shell script invokes local shell commands and parses hook input. It is not clearly malicious, but it is executable script behavior that can affect local Claude Reflect state.
Mittel
scripts/legacy/post-commit-reminder.sh:26
Shell command substitution
COUNT=$(jq 'length' "$QUEUE_FILE" 2>/dev/null || echo 0)
This legacy shell script invokes local shell commands and parses hook input. It is not clearly malicious, but it is executable script behavior that can affect local Claude Reflect state.
Mittel
scripts/legacy/post-commit-reminder.sh:1
Unix shell invocation
#!/bin/bash
This legacy shell script invokes local shell commands and parses hook input. It is not clearly malicious, but it is executable script behavior that can affect local Claude Reflect state.
Mittel
scripts/legacy/post-commit-reminder.sh:5
Hidden file access
QUEUE_FILE="$HOME/.claude/learnings-queue.json"
This legacy shell script accesses the hidden Claude Reflect queue or backup directory under the user home directory. That hidden-file access is real local persistence behavior.

Risikofunde

Bestätigte Sicherheitsbedenken werden von Punkten getrennt, die noch überprüft werden müssen.

Bestätigte Sicherheitsbedenken (13)

RISK-001 Hoch
commands/reflect.md:462
Environment file access
- Connection errors → Check .env for service URLs
The workflow extracts environment-related tool errors and proposes learnings about .env, DATABASE_URL, API keys, or service URLs. This can persist sensitive configuration context if the user approves unsafe text.
RISK-002 Hoch
commands/reflect.md:464
Environment file access
- Environment undefined → Load .env file first
The workflow extracts environment-related tool errors and proposes learnings about .env, DATABASE_URL, API keys, or service URLs. This can persist sensitive configuration context if the user approves unsafe text.
RISK-003 Hoch
commands/reflect.md:509
Environment file access
→ Proposed: "Check DATABASE_URL in .env for PostgreSQL connection"
The workflow extracts environment-related tool errors and proposes learnings about .env, DATABASE_URL, API keys, or service URLs. This can persist sensitive configuration context if the user approves unsafe text.
RISK-004 Hoch
commands/reflect.md:513
Environment file access
→ Proposed: "Load .env file before accessing environment variables"
The workflow extracts environment-related tool errors and proposes learnings about .env, DATABASE_URL, API keys, or service URLs. This can persist sensitive configuration context if the user approves unsafe text.
RISK-005 Hoch
scripts/lib/reflect_utils.py:386
Environment file access
"Check .env for service URLs - don't assume localhost"),
The utility classifies tool errors using patterns for DATABASE_URL, API_KEY, SECRET, Supabase, Postgres, and Redis configuration. Aggregating those errors can capture sensitive project configuration context.
RISK-006 Hoch
scripts/lib/reflect_utils.py:389
Environment file access
"Load .env file before accessing environment variables"),
The utility classifies tool errors using patterns for DATABASE_URL, API_KEY, SECRET, Supabase, Postgres, and Redis configuration. Aggregating those errors can capture sensitive project configuration context.
RISK-007 Hoch
scripts/lib/reflect_utils.py:393
Environment file access
"Check SUPABASE_URL and SUPABASE_KEY in .env"),
The utility classifies tool errors using patterns for DATABASE_URL, API_KEY, SECRET, Supabase, Postgres, and Redis configuration. Aggregating those errors can capture sensitive project configuration context.
RISK-008 Hoch
scripts/lib/reflect_utils.py:396
Environment file access
"Check DATABASE_URL in .env for PostgreSQL connection"),
The utility classifies tool errors using patterns for DATABASE_URL, API_KEY, SECRET, Supabase, Postgres, and Redis configuration. Aggregating those errors can capture sensitive project configuration context.
RISK-009 Hoch
scripts/lib/reflect_utils.py:399
Environment file access
"Check REDIS_URL in .env for Redis connection"),
The utility classifies tool errors using patterns for DATABASE_URL, API_KEY, SECRET, Supabase, Postgres, and Redis configuration. Aggregating those errors can capture sensitive project configuration context.
RISK-010 Hoch
scripts/capture_learning.py:24-63scripts/lib/reflect_utils.py:47-52scripts/lib/reflect_utils.py:178-186
Automatic User Prompt Capture
The UserPromptSubmit hook script reads the submitted prompt, detects correction patterns, and appends matching text to a persistent hidden queue. This can store sensitive user instructions if a correction contains private data.
The capture script directly reads stdin prompt data and saves queue items with the original message. The storage helper writes the queue to the user home Claude directory.
RISK-011 Hoch
commands/reflect.md:287-340commands/reflect.md:456-519scripts/lib/reflect_utils.py:414-504
Session History Mining For Persistent Learnings
The /reflect history workflow scans Claude Code session JSONL files and tool results, then converts selected findings into memory entries. This creates a privacy risk because session history can contain proprietary code, paths, credentials, and private user text.
The command explicitly locates session files and extracts user messages, tool rejections, and tool errors. The utility stores truncated tool error content and project identifiers for later aggregation.
RISK-012 Mittel
scripts/lib/semantic_detector.py:67-83scripts/lib/semantic_detector.py:295-315
Captured Text Sent To Claude CLI For Semantic Analysis
Semantic validation sends captured user messages and tool error samples to the local Claude CLI through subprocess calls. Depending on the Claude CLI configuration, this may disclose session content to an external model provider.
The subprocess calls pass constructed prompts through stdin to claude -p. The prompt templates contain user messages or sampled tool errors.
RISK-013 Niedrig
commands/reflect.md:248
System reconnaissance
**If "first-run" for this project AND user did NOT pass `--scan-history`:**
The command performs local reconnaissance of Claude project state to decide whether to scan historical sessions. This is expected for the feature, but it exposes local session metadata.

Abhilfemaßnahmen

Von diesem Audit vorgeschlagene Korrekturen wurden erfasst. Ihre Umsetzung liegt in der Verantwortung des Maintainers.

  1. FIX-001
    Hoch
    Automatic capture can persist sensitive user prompts.
    Require clear install-time consent, redact secrets before queueing, and avoid storing full prompt text when a shorter learning is enough.
  2. FIX-002
    Hoch
    History scanning reads Claude Code session files.
    Show the exact session files before scanning, default to the current project, and require confirmation for broad or all-project scans.
  3. FIX-003
    Hoch
    Tool error extraction can capture environment and credential context.
    Redact values for API_KEY, SECRET, DATABASE_URL, *_URL, and service tokens before display, storage, or semantic validation.
  4. FIX-004
    Mittel
    Semantic validation sends captured text to the Claude CLI.
    Document the data flow, add an opt-out flag, and skip semantic validation for messages that look sensitive.
  5. FIX-005
    Mittel
    Approved learnings modify CLAUDE.md and AGENTS.md.
    Create backups before edits and keep dry-run previews available for every write path.
  6. FIX-006
    Niedrig
    Legacy shell scripts remain in the package.
    Remove unused legacy scripts or clearly mark them as examples so installers do not execute stale implementations.

Expertennachweise

Unveränderliche Subjektidentität, Scanner-Metadaten, verworfene Treffer und Nachweise auf Quellcodeebene.

Artefakt-Subjekt

Marketplace-Commit
Nicht verfügbar
Inhalts-Hash
Nicht verfügbar
Tree-Hash
Nicht verfügbar
Skill-Pfad
Nicht verfügbar
Hash der Audit-Nutzlast
Nicht verfügbar

Analysemetadaten

Auditmodell: codex

Analysestatus: Vollständig

Der Umfang ist auf die aufgezeichneten Dateien, Zeilen, Methoden und Nachweise beschränkt. Es wird keine Ausführung in einer Laufzeitumgebung oder Sandbox beansprucht.

Verifizieren und exportieren

JSON-Bericht CITATION.cff SARIF 2.1.0 Signiertes Installationsmanifest

Das Manifest und die Lockdatei binden Installationsartefakte an kryptografische Hashes. Diese Integritätsaussage ist von der Sicherheitsbewertung getrennt.

Audit-Nachweis: not_attestable