finalize-step-review-retrospective
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill processes PR comment data (titles, bodies, and details) from automated and human reviewers to generate a qualitative quality assessment in Step 3.
- Ingestion points: Step 1 in
SKILL.mdreadspr-commentfindings using theplan-marshall:manage-findingstool. - Boundary markers: Absent. The workflow instructs the LLM to read and reason over the raw comment content without explicit delimiters or instructions to ignore embedded commands.
- Capability inventory: Across
SKILL.mdand referenced scripts, the skill can write files to the plan directory (plan-marshall:manage-files:manage-files write) and update step statuses. - Sanitization: No escaping, validation, or filtering of the external comment content is performed before interpolation into the prompt.
- [COMMAND_EXECUTION]: The skill executes local Python scripts using a platform-specific runner (
.plan/execute-script.py). This includes running a provided deterministic metrics aggregator (scripts/review_retrospective.py) and various platform management tools. These operations are limited to the local environment and intended for the skill's primary purpose of PR metrics aggregation.
Audit Metadata