retro
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: No security issues were detected. The skill's instructions and configuration are consistent with its stated purpose of performing diagnostics on coding sessions.
- [EXTERNAL_DOWNLOADS]: The skill's provenance records in
UPSTREAM.mdreference themattpocock/skillsrepository on GitHub for installation and version tracking. This is a standard reference to a public repository for managing skill lifecycle. - [DATA_EXPOSURE]: The skill reads local session logs and repository metadata files (e.g.,
package.json,CLAUDE.md,AGENTS.md). This access is localized to the agent's environment and is required for the retrospective functionality, with no evidence of data being exfiltrated to external domains. - [INDIRECT_PROMPT_INJECTION]: The skill ingests session logs, which creates a surface for indirect prompt injection from external data. However, the risk is negligible as the skill lacks high-privilege capabilities—such as arbitrary command execution or network access—that could be abused if malicious instructions were encountered in the logs.
Audit Metadata