skills/tanabee/skills/retro/Gen Agent Trust Hub

retro

Pass

Audited by Gen Agent Trust Hub on Oct 24, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by ingesting untrusted data from past conversation logs to automate the creation of permanent agent rules and settings. Malicious instructions contained in previous interactions (e.g., from an attacker-controlled file or website previously read by the agent) could be codified into the project's persistent configuration.
  • Ingestion points: Reads conversation history from ~/.claude/projects/*.jsonl and session facets from ~/.claude/usage-data/facets/*.json.
  • Boundary markers: None identified; the skill treats log content as valid signals for improvement without explicit delimiters.
  • Capability inventory: Can modify project files (Write, Edit) and execute shell commands (Bash).
  • Sanitization: No sanitization or verification of the content within the conversation logs is performed before proposing rule changes.
  • [DATA_EXFILTRATION]: The skill reads highly sensitive local files containing the user's full interaction history with the AI agent. While it does not exfiltrate this data over the network in the provided scripts, the access to these paths is significant.
  • Accesses ~/.claude/projects/ to read .jsonl session logs.
  • Accesses ~/.claude/usage-data/facets/ to read session metadata.
  • [COMMAND_EXECUTION]: The skill executes various shell commands to manage its state and process log data.
  • Runs claude -p "/insights" to generate usage analytics.
  • Uses date -Iseconds to manage its analysis window.
  • [DYNAMIC_EXECUTION]: The skill instructs the agent to use Python scripts at runtime to filter and extract specific entries from large log files.
  • Generates and executes Python logic to parse jsonl files for user messages and friction events.
  • [EXTERNAL_DOWNLOADS]: Fetches best practices and official documentation from Anthropic's verified domains to validate proposed configuration changes.
  • Retrieves information from https://code.claude.com/docs/llms.txt, https://www.anthropic.com/engineering/claude-code-best-practices, and https://claude.com/blog.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 24, 2026, 09:37 AM