The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a local shell script (retrospect-load-sessions.sh) using the Bash tool and passes raw user arguments ($@) directly to the shell. This pattern is vulnerable to command injection if the agent or the underlying script does not properly sanitize or quote the input arguments.
[PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from historical session logs, including previous user prompts and tool outputs. This creates a surface for indirect prompt injection.
Ingestion points: Session logs containing user_prompts, tool_calls, and JSONL events (extracted in Step 2).
Boundary markers: None identified; logs are processed directly without delimiters or instructions to ignore embedded commands.
Capability inventory: The skill has access to powerful tools including Bash, Write, Read, and Grep.
Sanitization: No evidence of sanitization or validation of the ingested log content before analysis.
[COMMAND_EXECUTION]: The skill requires high-privilege tools (Bash, Write) to perform its primary functions, such as loading session data and writing reports to the .retro/ directory. While consistent with the skill's purpose, these tools increase the potential impact of other vulnerabilities like command injection or indirect prompt injection.

retrospect-collab