sprint-retro
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized data exfiltration were detected. The skill operates on local repository data to generate development reports.
- [COMMAND_EXECUTION]: The skill provides transparent shell and PowerShell command snippets for extracting commit history and pull request data using 'git' and 'gh' CLI tools. These operations are within the expected scope of a development workflow utility.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes external data from git logs and PR metadata. Ingestion points: Git commit history and PR metadata (SKILL.md). Boundary markers: None present in the summarization prompts. Capability inventory: The skill enables file creation for retrospective documentation (SKILL.md). Sanitization: Input data is processed directly without filtering. This finding is assessed as low risk given the primary purpose of the skill.
Audit Metadata