retro

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.80). The prompt includes deceptive/side-effecting instructions outside the pure retrospective task—e.g., it writes telemetry and a repo basename to ~/.gstack/analytics and touches telemetry/intro flags (modifying user state and collecting metadata) while the user-facing text claims no repo/file paths are sent and “ONLY” one JSON snapshot is written, so it quietly performs out-of-scope data collection and state changes.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and ingests user-generated repository data (e.g., "git fetch origin " and multiple "git log origin/ --since=..." commands in Step 1) and parses commit messages, diffs, PR numbers, TODOS.md and other local/remote files as primary inputs to its analysis, so untrusted third‑party content (contributors' commits/messages/files) is read and can materially influence decisions and outputs.