retro

Pass

Audited by Gen Agent Trust Hub on Mar 23, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [PROMPT_INJECTION]: The skill processes untrusted content from git history and all markdown files within the docs/ directory. This data is used to direct automated agent tasks and project validation cycles without explicit sanitization or boundary markers, establishing a surface for indirect prompt injection.
  • Ingestion points: Git history (processed via /recall) and project documentation (docs/*.md).
  • Boundary markers: Not present.
  • Capability inventory: Execution of parallel agents, file system writes, and shell commands (build/test).
  • Sanitization: Not present.
  • [COMMAND_EXECUTION]: During the 'Self-Healing Validation' phase, the skill automatically executes shell commands to run the project's test suite and build/compile processes.
  • [DATA_EXFILTRATION]: The skill accesses and writes execution metadata to ~/.claude/projects/skill-telemetry.md. While used for telemetry, accessing and modifying files in hidden home directory paths constitutes a data exposure and persistence risk.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 23, 2026, 10:56 AM
Security Audit — agent-trust-hub — retro