The Agent Skills Directory

[COMMAND_EXECUTION]: The Python scripts (velocity_analyzer.py, contributor_insights.py, and code_churn_analyzer.py) use subprocess.run to execute local git commands. These executions are necessary for the skill's primary purpose of analyzing repository history. The implementation uses list-based arguments (e.g., ['git', '-C', repo] + args) rather than shell strings, which is a secure practice that prevents command injection vulnerabilities.
[SAFE]: The skill does not include any external dependencies or perform network operations. All analysis is performed on local git data. The logic follows standard software development practices for data aggregation and reporting.
[PROMPT_INJECTION]: The retro_report_generator.py script ingests data from external sources such as previous retrospective reports and commit history. This represents an indirect prompt injection surface; however, the script treats this data as literal text for inclusion in a Markdown report and does not use it to construct agent instructions or execute logic, rendering the risk negligible.

sprint-retrospective