incident-retrospective

Pass

Audited by Gen Agent Trust Hub on Jun 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a curl command to register an automation preset with the vendor's backend. The operation targets the OPENHANDS_HOST environment variable and utilizes the $OPENHANDS_AUTOMATION_API_KEY for authentication, both of which are provided by the vendor's runtime environment.
  • [PROMPT_INJECTION]: The skill establishes an automation that ingests untrusted data from Slack channels and Linear tickets into a prompt. This creates an indirect prompt injection surface where malicious or unexpected content in those external platforms could influence the agent's output during retrospective generation.
  • Ingestion points: Slack incident channel messages and Linear issue details.
  • Boundary markers: The setup instructions do not explicitly mandate the use of delimiters or 'ignore' instructions for the ingested content in the constructed prompt.
  • Capability inventory: The resulting automation is designed to read from Slack/Linear and write a drafted page to Notion.
  • Sanitization: No specific sanitization, escaping, or filtering logic is described for the external content before it is interpolated into the prompt.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 24, 2026, 08:21 AM
Security Audit — agent-trust-hub — incident-retrospective