agent-retro

SUSPICIOUS: the skill is locally scoped and has no external download or exfiltration path, but it reads broad prior conversations and persists derived guidance into USER.md, SOUL.md, AGENTS.md, and MEMORY.md without prior user approval. The main risk is prompt-injection persistence and unsafe autonomous self-modification, not malware.