Reflect Notes

Append to daily notes and create notes in Reflect. Use for capturing thoughts, todos, or syncing information to your knowledge graph.

This skill's code and instructions match its stated purpose (writing to Reflect) and are not outright malicious, but the registry metadata is inconsistent: it fails to declare the required env vars (REFLECT_TOKEN, REFLECT_GRAPH_ID) and does not list required binaries (curl, jq). Before installing: (1) verify the skill owner/source and that you trust https://reflect.app; (2) be prepared to provide a Reflect access token and graph id and store them securely (use a scoped token if possible); (3) ensure jq and curl are available on the agent environment; (4) remember anything sent to the skill will be written (append-only) to your Reflect — avoid sending secrets you don't want stored there; (5) consider running the script manually first to confirm behavior and update the registry metadata or ask the publisher to correct the declared requirements.

Type: OpenClaw Skill Name: reflect Version: 1.0.0 The skill bundle is benign. It provides a helper script (`scripts/reflect.sh`) and documentation (`SKILL.md`) for interacting with the Reflect API. All network calls are directed to `https://reflect.app`, and API tokens are securely handled via environment variables. The script uses `jq` for safe JSON payload construction, and there is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent.