release-retrospective
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external information such as release plans, communication logs, and support tickets provided by the user to generate a retrospective report.
- Ingestion points: User-supplied plan documents and qualitative data described in the 'Configuration' section of
SKILL.md. - Boundary markers: None explicitly defined to separate user input from the agent's internal instructions.
- Capability inventory: The skill uses
Writefor report generation andBashtools (git,rg,grep) for local repository metadata analysis. - Sanitization: The skill does not specify sanitization for the ingested data before processing into the final markdown report.
- [COMMAND_EXECUTION]: The skill utilizes local shell commands to extract release metadata and component usage from the repository history.
- Evidence:
Step 1binstructs the agent to usegit tagfor timeline verification andrg(ripgrep) to check for remaining references to deprecated components. - Context: These operations are restricted to the local repository and are used for metadata extraction consistent with the skill's stated purpose.
Audit Metadata