incident-retrospective
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a
curlcommand to register an automation preset with the vendor's backend. The operation targets theOPENHANDS_HOSTenvironment variable and utilizes the$OPENHANDS_AUTOMATION_API_KEYfor authentication, both of which are provided by the vendor's runtime environment. - [PROMPT_INJECTION]: The skill establishes an automation that ingests untrusted data from Slack channels and Linear tickets into a prompt. This creates an indirect prompt injection surface where malicious or unexpected content in those external platforms could influence the agent's output during retrospective generation.
- Ingestion points: Slack incident channel messages and Linear issue details.
- Boundary markers: The setup instructions do not explicitly mandate the use of delimiters or 'ignore' instructions for the ingested content in the constructed prompt.
- Capability inventory: The resulting automation is designed to read from Slack/Linear and write a drafted page to Notion.
- Sanitization: No specific sanitization, escaping, or filtering logic is described for the external content before it is interpolated into the prompt.
Audit Metadata