retro

SUSPICIOUS. The core git-analysis behavior is plausible, and its main external CLIs are mostly official, but the skill’s actual footprint is not well-contained: a retrospective tool also edits project config, migrates vendored setup, invokes many local helper binaries, and can auto-commit changes. This is more expansive than necessary for reporting and creates medium-high trust and scope risk without clear malicious exfiltration evidence.