retrospect-external-babysitter-run

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill requires reading and citing run artifacts (run.json, inputs.json, journal entries) and mandates line-anchored excerpts/evidence in the retrospective, which can force the LLM to reproduce secrets present in those files verbatim (and it gives no guidance to redact them).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes—Phase 2/4 shallow-clones an outsider’s public GitHub repo at runtime and then reads free-text JSON fields from .a5c/runs/<runId>/run.json, inputs.json, and journal/*.json (plus the referenced process file), which are then used to generate the retrospective in the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill shallow-clones external repositories at runtime using "gh repo clone / -- --depth 50 --single-branch" (SKILL.md:30), which fetches external files that are then read into the assistant's context and can directly control the prompts used for the retrospective.