release-retrospective

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external information such as release plans, communication logs, and support tickets provided by the user to generate a retrospective report.
  • Ingestion points: User-supplied plan documents and qualitative data described in the 'Configuration' section of SKILL.md.
  • Boundary markers: None explicitly defined to separate user input from the agent's internal instructions.
  • Capability inventory: The skill uses Write for report generation and Bash tools (git, rg, grep) for local repository metadata analysis.
  • Sanitization: The skill does not specify sanitization for the ingested data before processing into the final markdown report.
  • [COMMAND_EXECUTION]: The skill utilizes local shell commands to extract release metadata and component usage from the repository history.
  • Evidence: Step 1b instructs the agent to use git tag for timeline verification and rg (ripgrep) to check for remaining references to deprecated components.
  • Context: These operations are restricted to the local repository and are used for metadata extraction consistent with the skill's stated purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 08:20 PM