retro
Pass
Audited by Gen Agent Trust Hub on Feb 27, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill facilitates the capture of untrusted user input (implementation feedback) and writes it to a persistent local file (
.groom/retro.md).\n - Ingestion points: User input captured through interactive prompts (e.g., issue numbers, scope changes, blockers) or command arguments.\n
- Boundary markers: The skill uses Markdown headers (e.g.,
## Entry:) but does not implement specific delimiters or 'ignore' instructions to prevent a downstream agent from accidentally executing commands embedded in the feedback.\n - Capability inventory: The skill appends data to a local file system path within the repository context.\n
- Sanitization: No explicit sanitization, escaping, or validation of the user-provided input is performed before writing to the file.\n- [NO_CODE]: This skill does not include any executable scripts or binaries, relying solely on natural language instructions for the agent.
Audit Metadata