retro-private-skills
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs shell operations to manage a Git repository, including executing commands such as git fetch, git commit, git push, and git pull --rebase. It also resolves environment variables using PowerShell commands like [Environment]::GetEnvironmentVariable.
- [COMMAND_EXECUTION]: The skill invokes a local script located at /scripts/Sync-CopilotSkillsToPrivateRepo.ps1 as part of its intake workflow to mirror local skills.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from session logs, Git diffs, and terminal history to generate skill content, creating a surface for indirect prompt injection.
- Ingestion points: Error logs, Git diffs, conversation summaries, and terminal history (SKILL.md).
- Boundary markers: The skill instructions specify a 'Hard Scope Gate' to limit output locations, although they do not define explicit delimiters for the ingested input text.
- Capability inventory: The skill can write files, stage changes, commit, and push to a remote repository via shell commands.
- Sanitization: The instructions mandate scanning for secrets and abstracting customer-specific data before committing, which serves as a safety control for external content.
Audit Metadata