Dieser Bericht ist nicht in der angeforderten Sprache verfügbar. Stattdessen wird der maßgebliche englische Bericht angezeigt.

Versionierte Sicherheitsbewertung

Berichts-ID: SA-1B5B6C49

7/7/2026, 5:39:58 PM

claude-reflect Sicherheitsbewertung v8

Zertifizierungsbericht zur Skill-Sicherheit

Audit-Verlauf
Auditmodell: codex Historischer Bericht
Skillname
claude-reflect
Version
v8
Betreuer
BayramAnnakov
Quelle
github.com/BayramAnnakov/claude-reflect/tree/main/
Abdeckung
8 Gescannte Dateien · 1,260 Analysierte Zeilen
Richtlinienversion
Nicht verfügbar

Höchster bestätigter Schweregrad eines Befunds

Hoch

3 bestätigte Sicherheitsbefunde erfordern Aufmerksamkeit.

Installationskontext

Historische Nachweise

Dieser Bericht beschreibt möglicherweise nicht das derzeit installierbare Artefakt. Öffnen Sie die aktuelle Skill-Seite für Installationshinweise.

Aktuelle Skill-Seite öffnen

Dieser Bericht blockiert oder autorisiert weder das Manifest noch die ZIP-Datei.

The static command, network, and reconnaissance alerts are mostly markdown documentation false positives. The filesystem alerts are confirmed because the skill intentionally reads and writes Claude Code memory, rules, queues, settings, session history, and command files under hidden directories.

Position melden

Historischer Bericht

Öffnen Sie den Auditverlauf, bevor Sie diesen Bericht zur Installation verwenden.

Audit-Nachweis

Nicht bescheinigungsfähig

Die erforderliche unveränderliche Bindung ist unvollständig.

Menschliche Überprüfung

Nicht überprüft

Für diesen Bericht ist keine menschliche Überprüfung verzeichnet.

Abdeckung

8 Gescannte Dateien · 1,260 Analysierte Zeilen

56 Elemente zur Überprüfung angezeigt

Einschränkungen

Dieser Bericht beansprucht keine Laufzeit- oder Sandbox-Ausführung und beweist nicht das Fehlen von Nebenwirkungen.

Beweiskette

Folgen Sie den Nachweisen von der Quellenbindung bis zum Installationsvertrag. Verfügbare Nachweise unterstützen die Überprüfung; sie sind keine Sicherheitsgarantie.

  1. Quelle

    Bindung nicht verfügbar

  2. Artefakt

    Identität unvollständig

  3. Prüfung

    Vollständig

  4. Installationsvertrag

    Manifest zur Überprüfung öffnen

    Manifest öffnen

Beobachtete Funktionen

„Beobachtet“ bedeutet, dass dieser Bericht unterstützende Nachweise erfasst hat. Nicht erfasst bedeutet nicht, dass eine Fähigkeit nicht vorhanden ist.

Enthält Skripte

Kann mit dem Skill enthaltenen Code ausführen.

Durch dieses Audit nicht erfasst

Netzwerkzugriff

Kann eine Verbindung zu externen Diensten herstellen.

An 8 Nachweisstellen beobachtet

Dateisystemzugriff

Kann lokale Dateien lesen oder schreiben.

An 29 Nachweisstellen beobachtet

Umgebungsvariablen

Kann Werte aus der Prozessumgebung lesen.

Durch dieses Audit nicht erfasst

Externe Befehle

Kann Befehle oder Programme außerhalb des Skills aufrufen.

An 24 Nachweisstellen beobachtet

Elemente der Fähigkeitsprüfung (53)
Hoch
CHANGELOG.md:17
Hidden file in home directory
- Queue files at `~/.claude/projects/<encoded>/learnings-queue.json`
The changelog describes intended access to Claude Code hidden queues, rules, memory, or settings under ~/.claude. This is real persistent state access, although it is documented behavior.
Hoch
CHANGELOG.md:40
Hidden file in home directory
- `~/.claude/rules/*.md` — User-level global rule files
The changelog describes intended access to Claude Code hidden queues, rules, memory, or settings under ~/.claude. This is real persistent state access, although it is documented behavior.
Hoch
CHANGELOG.md:42
Hidden file in home directory
- Auto memory (`~/.claude/projects/<project>/memory/*.md`) — Low-confidence staging area
The changelog describes intended access to Claude Code hidden queues, rules, memory, or settings under ~/.claude. This is real persistent state access, although it is documented behavior.
Hoch
CHANGELOG.md:65
Hidden file in home directory
- `find_claude_files()` now discovers `CLAUDE.local.md`, `.claude/rules/*.md`, and `~/.claude/rules/
The changelog describes intended access to Claude Code hidden queues, rules, memory, or settings under ~/.claude. This is real persistent state access, although it is documented behavior.
Hoch
CHANGELOG.md:75
Hidden file in home directory
- Self-resolving: warning disappears once user adds `{"cleanupPeriodDays": 99999}` to `~/.claude/set
The changelog describes intended access to Claude Code hidden queues, rules, memory, or settings under ~/.claude. This is real persistent state access, although it is documented behavior.
Hoch
CLAUDE.md:26
Hidden file in home directory
1. User prompt → `capture_learning.py` (UserPromptSubmit hook) → `~/.claude/learnings-queue.json`
The architecture documentation names ~/.claude memory, rules, queues, and session files as workflow inputs or targets. These are persistent hidden Claude Code files, so the access is real.
Hoch
CLAUDE.md:28
Hidden file in home directory
3. Session files live at `~/.claude/projects/[PROJECT_FOLDER]/*.jsonl`
The architecture documentation names ~/.claude memory, rules, queues, and session files as workflow inputs or targets. These are persistent hidden Claude Code files, so the access is real.
Hoch
CLAUDE.md:34
Hidden file in home directory
| Global CLAUDE.md | `~/.claude/CLAUDE.md` | `global` | Always enabled |
The architecture documentation names ~/.claude memory, rules, queues, and session files as workflow inputs or targets. These are persistent hidden Claude Code files, so the access is real.
Hoch
CLAUDE.md:39
Hidden file in home directory
| User Rules | `~/.claude/rules/*.md` | `user-rule` | Global modular rules |
The architecture documentation names ~/.claude memory, rules, queues, and session files as workflow inputs or targets. These are persistent hidden Claude Code files, so the access is real.
Hoch
CLAUDE.md:40
Hidden file in home directory
| Auto Memory | `~/.claude/projects/<project>/memory/*.md` | `auto-memory` | Low-confidence staging
The architecture documentation names ~/.claude memory, rules, queues, and session files as workflow inputs or targets. These are persistent hidden Claude Code files, so the access is real.
Hoch
CLAUDE.md:63
Hidden file in home directory
cat ~/.claude/learnings-queue.json
The development instructions read, scan, or overwrite files under ~/.claude, including queue and session history paths. This is real hidden-directory access that can expose or alter user memory.
Hoch
CLAUDE.md:66
Hidden file in home directory
python3 scripts/extract_session_learnings.py ~/.claude/projects/[PROJECT]/*.jsonl --corrections-only
The development instructions read, scan, or overwrite files under ~/.claude, including queue and session history paths. This is real hidden-directory access that can expose or alter user memory.
Hoch
CLAUDE.md:72
Hidden file in home directory
echo "[]" > ~/.claude/learnings-queue.json
The development instructions read, scan, or overwrite files under ~/.claude, including queue and session history paths. This is real hidden-directory access that can expose or alter user memory.
Hoch
CLAUDE.md:125
Hidden file in home directory
Session files are JSONL at `~/.claude/projects/[PROJECT_FOLDER]/`:
The architecture documentation names ~/.claude memory, rules, queues, and session files as workflow inputs or targets. These are persistent hidden Claude Code files, so the access is real.
Hoch
DISTRIBUTION.md:59
Hidden file in home directory
- **Multi-target sync**: Updates ~/.claude/CLAUDE.md, ./CLAUDE.md, and AGENTS.md (industry standard)
The distribution copy states that the plugin syncs approved learnings into ~/.claude/CLAUDE.md. That is an intended write to persistent user-level Claude Code memory.
Hoch
README.md:148
Hidden file in home directory
- `~/.claude/CLAUDE.md` (global - applies to all projects)
The README describes syncing approved learnings into ~/.claude/CLAUDE.md and related memory targets. This is intended persistent user-level agent memory access.
Hoch
README.md:279
Hidden file in home directory
rm -rf ~/.claude/plugins/marketplaces/claude-reflect-marketplace
The upgrade steps instruct users to remove specific plugin cache directories under ~/.claude. The command is scoped, but it still modifies hidden Claude Code home state.
Hoch
README.md:280
Hidden file in home directory
rm -rf ~/.claude/plugins/cache/claude-reflect-marketplace
The upgrade steps instruct users to remove specific plugin cache directories under ~/.claude. The command is scoped, but it still modifies hidden Claude Code home state.
Hoch
README.md:400
Hidden file in home directory
7. **Extend session retention** - Claude Code deletes local sessions after 30 days by default. Since
The README advises changing ~/.claude/settings.json to retain local sessions for a very long period. This is real hidden-file access with privacy and retention impact.
Hoch
SKILL.md:13
Hidden file in home directory
Hooks detect correction patterns ("no, use X", "actually...", "use X not Y") and queue them to `~/.c
The skill instructions route captured corrections into ~/.claude and .claude memory, rules, and command files after review. This is real persistent agent memory access.
Hoch
SKILL.md:48
Hidden file in home directory
- `~/.claude/CLAUDE.md` - Global learnings (model names, general patterns)
The skill instructions route captured corrections into ~/.claude and .claude memory, rules, and command files after review. This is real persistent agent memory access.
Hoch
SKILL.md:52
Hidden file in home directory
- `~/.claude/rules/*.md` - Global modular rules
The skill instructions route captured corrections into ~/.claude and .claude memory, rules, and command files after review. This is real persistent agent memory access.
Hoch
SKILL.md:53
Hidden file in home directory
- `~/.claude/projects/<project>/memory/*.md` - Auto memory (low-confidence, exploratory)
The skill instructions route captured corrections into ~/.claude and .claude memory, rules, and command files after review. This is real persistent agent memory access.
Hoch
SKILL.md:67
Hidden file in home directory
Apply to ~/.claude/CLAUDE.md? [y/n]
The skill instructions route captured corrections into ~/.claude and .claude memory, rules, and command files after review. This is real persistent agent memory access.
Mittel
CHANGELOG.md:17
Hidden file access
- Queue files at `~/.claude/projects/<encoded>/learnings-queue.json`
The changelog describes intended access to Claude Code hidden queues, rules, memory, or settings under ~/.claude. This is real persistent state access, although it is documented behavior.
Mittel
CHANGELOG.md:40
Hidden file access
- `~/.claude/rules/*.md` — User-level global rule files
The changelog describes intended access to Claude Code hidden queues, rules, memory, or settings under ~/.claude. This is real persistent state access, although it is documented behavior.
Mittel
CHANGELOG.md:42
Hidden file access
- Auto memory (`~/.claude/projects/<project>/memory/*.md`) — Low-confidence staging area
The changelog describes intended access to Claude Code hidden queues, rules, memory, or settings under ~/.claude. This is real persistent state access, although it is documented behavior.
Mittel
CHANGELOG.md:65
Hidden file access
- `find_claude_files()` now discovers `CLAUDE.local.md`, `.claude/rules/*.md`, and `~/.claude/rules/
The changelog describes intended access to Claude Code hidden queues, rules, memory, or settings under ~/.claude. This is real persistent state access, although it is documented behavior.
Mittel
CHANGELOG.md:75
Hidden file access
- Self-resolving: warning disappears once user adds `{"cleanupPeriodDays": 99999}` to `~/.claude/set
The changelog describes intended access to Claude Code hidden queues, rules, memory, or settings under ~/.claude. This is real persistent state access, although it is documented behavior.
Mittel
CLAUDE.md:26
Hidden file access
1. User prompt → `capture_learning.py` (UserPromptSubmit hook) → `~/.claude/learnings-queue.json`
The architecture documentation names ~/.claude memory, rules, queues, and session files as workflow inputs or targets. These are persistent hidden Claude Code files, so the access is real.
Mittel
CLAUDE.md:28
Hidden file access
3. Session files live at `~/.claude/projects/[PROJECT_FOLDER]/*.jsonl`
The architecture documentation names ~/.claude memory, rules, queues, and session files as workflow inputs or targets. These are persistent hidden Claude Code files, so the access is real.
Mittel
CLAUDE.md:34
Hidden file access
| Global CLAUDE.md | `~/.claude/CLAUDE.md` | `global` | Always enabled |
The architecture documentation names ~/.claude memory, rules, queues, and session files as workflow inputs or targets. These are persistent hidden Claude Code files, so the access is real.
Mittel
CLAUDE.md:38
Hidden file access
| Project Rules | `./.claude/rules/*.md` | `rule` | Modular, path-scoped |
The architecture documentation names ~/.claude memory, rules, queues, and session files as workflow inputs or targets. These are persistent hidden Claude Code files, so the access is real.
Mittel
CLAUDE.md:39
Hidden file access
| User Rules | `~/.claude/rules/*.md` | `user-rule` | Global modular rules |
The architecture documentation names ~/.claude memory, rules, queues, and session files as workflow inputs or targets. These are persistent hidden Claude Code files, so the access is real.
Mittel
CLAUDE.md:40
Hidden file access
| Auto Memory | `~/.claude/projects/<project>/memory/*.md` | `auto-memory` | Low-confidence staging
The architecture documentation names ~/.claude memory, rules, queues, and session files as workflow inputs or targets. These are persistent hidden Claude Code files, so the access is real.
Mittel
CLAUDE.md:63
Hidden file access
cat ~/.claude/learnings-queue.json
The development instructions read, scan, or overwrite files under ~/.claude, including queue and session history paths. This is real hidden-directory access that can expose or alter user memory.
Mittel
CLAUDE.md:66
Hidden file access
python3 scripts/extract_session_learnings.py ~/.claude/projects/[PROJECT]/*.jsonl --corrections-only
The development instructions read, scan, or overwrite files under ~/.claude, including queue and session history paths. This is real hidden-directory access that can expose or alter user memory.
Mittel
CLAUDE.md:72
Hidden file access
echo "[]" > ~/.claude/learnings-queue.json
The development instructions read, scan, or overwrite files under ~/.claude, including queue and session history paths. This is real hidden-directory access that can expose or alter user memory.
Mittel
CLAUDE.md:125
Hidden file access
Session files are JSONL at `~/.claude/projects/[PROJECT_FOLDER]/`:
The architecture documentation names ~/.claude memory, rules, queues, and session files as workflow inputs or targets. These are persistent hidden Claude Code files, so the access is real.
Mittel
DISTRIBUTION.md:59
Hidden file access
- **Multi-target sync**: Updates ~/.claude/CLAUDE.md, ./CLAUDE.md, and AGENTS.md (industry standard)
The distribution copy states that the plugin syncs approved learnings into ~/.claude/CLAUDE.md. That is an intended write to persistent user-level Claude Code memory.
Mittel
README.md:148
Hidden file access
- `~/.claude/CLAUDE.md` (global - applies to all projects)
The README describes syncing approved learnings into ~/.claude/CLAUDE.md and related memory targets. This is intended persistent user-level agent memory access.
Mittel
README.md:151
Hidden file access
- `./.claude/commands/*.md` (skill files - when correction relates to a skill)
The README describes writing generated or updated command files under project .claude directories. This is real hidden project-state access that can affect future agent behavior.
Mittel
README.md:217
Hidden file access
~/projects/my-productivity-tools/.claude/commands/daily-review.md
The README describes writing generated or updated command files under project .claude directories. This is real hidden project-state access that can affect future agent behavior.
Mittel
README.md:218
Hidden file access
~/projects/my-webapp/.claude/commands/deploy-app.md
The README describes writing generated or updated command files under project .claude directories. This is real hidden project-state access that can affect future agent behavior.
Mittel
README.md:279
Hidden file access
rm -rf ~/.claude/plugins/marketplaces/claude-reflect-marketplace
The upgrade steps instruct users to remove specific plugin cache directories under ~/.claude. The command is scoped, but it still modifies hidden Claude Code home state.
Mittel
README.md:280
Hidden file access
rm -rf ~/.claude/plugins/cache/claude-reflect-marketplace
The upgrade steps instruct users to remove specific plugin cache directories under ~/.claude. The command is scoped, but it still modifies hidden Claude Code home state.
Mittel
README.md:400
Hidden file access
7. **Extend session retention** - Claude Code deletes local sessions after 30 days by default. Since
The README advises changing ~/.claude/settings.json to retain local sessions for a very long period. This is real hidden-file access with privacy and retention impact.
Mittel
SKILL.md:13
Hidden file access
Hooks detect correction patterns ("no, use X", "actually...", "use X not Y") and queue them to `~/.c
The skill instructions route captured corrections into ~/.claude and .claude memory, rules, and command files after review. This is real persistent agent memory access.
Mittel
SKILL.md:48
Hidden file access
- `~/.claude/CLAUDE.md` - Global learnings (model names, general patterns)
The skill instructions route captured corrections into ~/.claude and .claude memory, rules, and command files after review. This is real persistent agent memory access.
Mittel
SKILL.md:51
Hidden file access
- `./.claude/rules/*.md` - Modular rules with optional path-scoping
The skill instructions route captured corrections into ~/.claude and .claude memory, rules, and command files after review. This is real persistent agent memory access.
Mittel
SKILL.md:52
Hidden file access
- `~/.claude/rules/*.md` - Global modular rules
The skill instructions route captured corrections into ~/.claude and .claude memory, rules, and command files after review. This is real persistent agent memory access.
Mittel
SKILL.md:53
Hidden file access
- `~/.claude/projects/<project>/memory/*.md` - Auto memory (low-confidence, exploratory)
The skill instructions route captured corrections into ~/.claude and .claude memory, rules, and command files after review. This is real persistent agent memory access.
Mittel
SKILL.md:67
Hidden file access
Apply to ~/.claude/CLAUDE.md? [y/n]
The skill instructions route captured corrections into ~/.claude and .claude memory, rules, and command files after review. This is real persistent agent memory access.

Risikofunde

Bestätigte Sicherheitsbedenken werden von Punkten getrennt, die noch überprüft werden müssen.

Bestätigte Sicherheitsbedenken (3)

RISK-001 Hoch
SKILL.md:48-53README.md:145-154CLAUDE.md:30-42
Persistent Agent Memory Modification
The skill is designed to place approved corrections into global and project Claude Code memory files. This can persist instructions across future sessions and projects.
Multiple files describe the same memory destinations, including global ~/.claude files and project command directories. The behavior is core to the skill design.
RISK-002 Mittel
README.md:156-185CLAUDE.md:123-128CHANGELOG.md:73-76
Session History Mining Privacy Risk
The workflow analyzes local Claude Code session history to find corrections and repeated work patterns. Session files may contain sensitive prompts, paths, and project context.
The documentation explicitly describes scanning past sessions and increasing session retention. The privacy concern follows directly from those data sources.
RISK-003 Mittel
README.md:221-248README.md:250-264CLAUDE.md:166-185
Generated Skill File Persistence
The skill can generate or update command files from observed user behavior. Incorrectly accepted output could create persistent agent workflows or guardrails.
The README and repository guidance describe generated skill files and routing corrections back into skill definitions. Human approval lowers risk but does not remove persistence impact.

Abhilfemaßnahmen

Von diesem Audit vorgeschlagene Korrekturen wurden erfasst. Ihre Umsetzung liegt in der Verantwortung des Maintainers.

  1. FIX-001
    Hoch
    Persistent writes to agent memory files
    Show a destination, diff, and scope choice before every write. Keep global memory updates disabled until the user explicitly selects them.
  2. FIX-002
    Mittel
    Session history scanning and long retention
    Limit scan ranges by default, exclude sensitive projects, and avoid recommending very long session retention as the default setup.
  3. FIX-003
    Mittel
    Generated command and skill updates
    Create drafts first, require human review, and label generated instructions before writing to command directories.
  4. FIX-004
    Niedrig
    Manual recursive cache cleanup instructions
    Prefer Claude Code uninstall or update commands, or provide a guarded cleanup script that verifies exact plugin paths.

Expertennachweise

Unveränderliche Subjektidentität, Scanner-Metadaten, verworfene Treffer und Nachweise auf Quellcodeebene.

Artefakt-Subjekt

Marketplace-Commit
Nicht verfügbar
Inhalts-Hash
Nicht verfügbar
Tree-Hash
Nicht verfügbar
Skill-Pfad
Nicht verfügbar
Hash der Audit-Nutzlast
Nicht verfügbar

Analysemetadaten

Auditmodell: codex

Analysestatus: Vollständig

Der Umfang ist auf die aufgezeichneten Dateien, Zeilen, Methoden und Nachweise beschränkt. Es wird keine Ausführung in einer Laufzeitumgebung oder Sandbox beansprucht.

Verifizieren und exportieren

JSON-Bericht CITATION.cff SARIF 2.1.0 Signiertes Installationsmanifest

Das Manifest und die Lockdatei binden Installationsartefakte an kryptografische Hashes. Diese Integritätsaussage ist von der Sicherheitsbewertung getrennt.

Audit-Nachweis: not_attestable