retrospect-report
Pass
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local script
retrospect-load-sessions.shusing the Bash tool to filter session data based on user-provided arguments. - [PROMPT_INJECTION]: The skill extracts content from previous sessions, including user prompts and collaboration insights, to generate aggregate reports. This constitutes an indirect prompt injection surface as it processes untrusted historical data.
- Ingestion points: Session files and files within the
.retro/insights/directory (SKILL.md). - Boundary markers: None identified. Raw session data is interpolated into the report template without delimiters.
- Capability inventory: Uses
Bash,Read,Write, andGreptools. - Sanitization: No validation or escaping of the content extracted from session logs is performed before writing the report.
Audit Metadata