retro
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local shell script located at
.claude/lib/checkpoint.sh. This execution includes user-provided or environment-derived variables such as<run-dir>, which could potentially be manipulated to execute unintended command sequences if the input is not strictly validated by the platform. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources like
loop-ledger.tsv,STATUS.md, and project specification files. This content is treated as evidence and could contain adversarial text designed to influence the agent's subsequent actions during the retro process. - Ingestion points: Files read in Phase 1 (SKILL.md), including logs and spec descriptions.
- Boundary markers: The instructions do not define explicit delimiters or 'ignore' instructions for the external content being processed.
- Capability inventory: The skill possesses the ability to write to files (Phase 4 and 5) and execute shell commands (Phase 5).
- Sanitization: There are no documented steps for sanitizing or escaping the content read from external files before processing.
Audit Metadata