Security audit

Launch Retro Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed marketing launch-retrospective helper with limited, purpose-aligned memory and registry proposal writes.

Before installing, be aware that the skill is designed to process launch analytics and save retrospectives or registry proposals when you approve. Review the analytics exports you provide and confirm only the memory saves or registry proposals you want retained.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: ## Save Results On user confirmation, save to `memory/launch/launch-retro-analyzer/YYYY-MM-DD-<launch-or-product>-retro.md` — see [Skill Contract](../../../references/skill-contract.md) §Save Results Template. Ask "Save these results for future sessions?" first; do not write memory without asking. Registry-bound facts (the outcome snapshot) go only to `memory/events/launches.ndjson` via an authorized `operation: propose` request to `registry-events.py` — never to the registry records themselves. ## Reference Materials
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.