speckit-opsmill-retrospect

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local repository script located at .specify/scripts/bash/check-prerequisites.sh. While this is part of the expected project structure, executing scripts from the target repository allows for local command execution determined by the repository's contents.
  • [COMMAND_EXECUTION]: The skill performs shell operations including git rev-parse, git branch, git status, and gh issue create (if the creating-issues skill is unavailable). These are used for context gathering and approved follow-up actions.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it processes untrusted data from the repository and conversation history to determine automated code changes (fix-now).
  • Ingestion points: Conversation context, recent command history, repository documentation (AGENTS.md, dev/guides/, etc.), and user-provided $ARGUMENTS.
  • Boundary markers: The instructions do not specify explicit delimiters or 'ignore' instructions for the data ingested from the repository or transcript.
  • Capability inventory: The agent can write to repository files, execute shell commands (git, gh), and create GitHub issues.
  • Sanitization: The skill relies on human review and explicit approval phases (Phase 4 and Phase 6) to mitigate malicious output from being applied.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 09:10 PM
Security Audit — agent-trust-hub — speckit-opsmill-retrospect