Is ivangdavila/reflection safe?
Yes. ivangdavila/reflection is safe to install. Oathe's behavioral security audit gave the reflection skill by ivangdavila a trust score of 89/100 with 4 findings, none critical or high.
https://clawhub.ai/ivangdavila/reflection
Is ivangdavila/reflection safe to install?
This is a legitimate quality assurance skill that provides pre-delivery evaluation and learns from user corrections to prevent repeated mistakes. While it accessed sensitive files during installation, this appears incidental to system operations rather than malicious behavior.
What security issues were found in ivangdavila/reflection?
Category Scores
Findings (4)
MEDIUM Sensitive Files Accessed During Installation -25 ▶
The skill installation process accessed sensitive canary files including .env, SSH keys, and AWS credentials. While no data was modified or exfiltrated, this access occurred during system operations.
LOW Information Accumulation Risk -15 ▶
The skill creates persistent memory files in ~/reflection/ that accumulate user interaction patterns, corrections, and project insights over time, which could be valuable if accessed by attackers.
LOW File System Access for Memory -10 ▶
The skill requests file system access to create and maintain memory files, which is clearly disclosed and necessary for its stated functionality.
INFO Standard Git Operations -5 ▶
Installation involved normal git clone operations with expected network connections to GitHub and DNS resolution.
Should I install ivangdavila/reflection?
Oathe's verdict for ivangdavila/reflection is SAFE with a trust score of 89/100. Recommendation: Install.