retro
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFECREDENTIALS_UNSAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: Access to sensitive session transcripts. The skill directs the agent to locate and read logs from paths like
~/.claude/projects,~/.codex/sessions, and~/.pi/agent/sessions. These files may contain private code, environment details, and sensitive information from previous sessions. - [INDIRECT_PROMPT_INJECTION]: Ingestion of untrusted session data. The skill relies on reading past transcripts and repository markdown files (
AGENTS.md,CLAUDE.md) to decide on setup changes. - Ingestion points:
~/.claude/projects,~/.codex/sessions,~/.pi/agent/sessions,AGENTS.md,CLAUDE.md - Boundary markers: Absent
- Capability inventory: Modifying repository setup, editing files, and executing check commands
- Sanitization: Instructions exist to avoid quoting secrets in reports, but no sanitization of the input data for injection patterns is defined.
- [COMMAND_EXECUTION]: Modification and execution of repository scripts. The skill authorizes the agent to propose and apply changes to package scripts, pre-commit hooks, and CI workflows, which are then verified by execution.
- [DYNAMIC_EXECUTION]: Execution of dynamically modified local scripts. The agent is encouraged to run 'check commands' and verify modified hooks within the repository context.
Audit Metadata