speckit-opsmill-retrospect
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local repository script located at
.specify/scripts/bash/check-prerequisites.sh. While this is part of the expected project structure, executing scripts from the target repository allows for local command execution determined by the repository's contents. - [COMMAND_EXECUTION]: The skill performs shell operations including
git rev-parse,git branch,git status, andgh issue create(if thecreating-issuesskill is unavailable). These are used for context gathering and approved follow-up actions. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it processes untrusted data from the repository and conversation history to determine automated code changes (
fix-now). - Ingestion points: Conversation context, recent command history, repository documentation (
AGENTS.md,dev/guides/, etc.), and user-provided$ARGUMENTS. - Boundary markers: The instructions do not specify explicit delimiters or 'ignore' instructions for the data ingested from the repository or transcript.
- Capability inventory: The agent can write to repository files, execute shell commands (git, gh), and create GitHub issues.
- Sanitization: The skill relies on human review and explicit approval phases (
Phase 4andPhase 6) to mitigate malicious output from being applied.
Audit Metadata