OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Pass3 providerslatest audit Sep 2, 2026
Independent checks from skills.sh's audit partners.
The 'reflect' skill analyzes conversation transcripts to generate or update agent skill instructions. While it includes safety instructions for subagents and requires human approval before applying changes, it introduces a risk of indirect prompt injection because it processes untrusted user history to create persistent modifications to future agent behavior.
Detected behaviors
No alerts
No issues