retro
Warn
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses sensitive local directories and files containing agent session history and global configuration instructions.
- Evidence: Accesses ~/.copilot/session-state/, ~/.codex/sessions/, and ~/.claude/projects/ to read JSONL session transcripts.
- Evidence: Reads global instruction files including ~/.copilot/copilot-instructions.md, ~/.codex/AGENTS.md, and ~/.claude/CLAUDE.md.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from session transcripts and repository-specific files which could contain malicious instructions designed to influence the agent's retrospective conclusions or environment modifications.
- Ingestion points: SKILL.md specifies reading primary sources from transcripts and .workflow/ directory files (e.g., plan.md, learnings.md).
- Boundary markers: The instructions lack explicit delimiters or warnings to ignore embedded instructions within the processed data.
- Capability inventory: The skill utilizes memory.remember and workflow tools to apply approved changes to the agent's environment and repository files.
- Sanitization: There is no evidence of sanitization or filtering of the transcript content before generating retrospective candidates.
Audit Metadata