Security audit

ai-retrospective

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent retrospective purpose, but it can analyze full conversations and automatically write reports or persistent knowledge without enough per-run user control.

Review this skill before installing. It is not showing evidence of malware or exfiltration, but it should be treated as a privacy-sensitive retrospective tool: use explicit invocation, avoid running it in sessions containing secrets or confidential material, and require confirmation before it saves reports or persists memory/config updates.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases include very generic terms like 'retrospective', 'retro', and 'review this session', which can plausibly occur in normal conversation and unintentionally activate the skill. In this skill’s context, accidental activation is meaningful because the workflow analyzes full conversation history and may generate files or persist knowledge, creating unintended processing of potentially sensitive session content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README promises that the skill will save a report to file and auto-persist knowledge, but it does not prominently warn users that this may write conversation-derived content, preferences, or decisions to storage. Because this skill is specifically designed to mine complete session history, those writes can capture sensitive code context, internal decisions, or user preferences without sufficiently informed consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented trigger phrases include very broad everyday terms like 'review this session' and '回顾一下', which can plausibly appear in normal conversation and unintentionally activate the retrospective workflow. In this skill's context, accidental activation can cause unnecessary analysis of the full conversation and may cascade into report generation and persistence, increasing privacy and workflow risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README states that the skill will scan conversation history, output a full report, save it to a file, and automatically persist knowledge, but it does not prominently warn users about data handling, storage location, or consent. Because conversation histories often contain credentials, proprietary code, incident details, or personal data, silently analyzing and persisting that content can create confidentiality and compliance exposure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrase '复盘' is very short and common in normal conversation, so the skill may activate unintentionally during ordinary requests. Because this skill can perform file writes and memory persistence, accidental activation could cause unexpected workspace modifications or broad conversation analysis without a clearly scoped user request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger 'retrospective' is generic and likely to appear in ordinary project discussions, making unintended invocation plausible. In this skill, activation exposes a workflow that analyzes the full session and may write reports, so a false trigger has privacy and integrity consequences beyond mere inconvenience.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger 'retro' is especially ambiguous and overlaps heavily with common shorthand in conversation. That increases the chance the skill runs without the user intending a full-session review, which could disclose session content in chat or create artifacts in the workspace.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Requiring the complete analysis to be shown directly in conversation encourages the assistant to restate potentially sensitive material from the full session history. This can amplify exposure of secrets, internal code details, credentials, personal data, or confidential user statements that were previously only present in earlier context.
Content: No source excerpt is available for this finding.

Unbounded Output

Medium

Category: Output Handling
Confidence: 84% confidence
Finding: The instruction to show the complete analysis in full with 'no trimming' can force very large outputs based on the entire session history. This increases the risk of denial-of-service-like behavior through token exhaustion, degraded usability, and accidental over-disclosure of sensitive material embedded anywhere in prior turns.
Content: Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.
md
**The complete analysis must be shown directly in the conversation** — don't just output a summary and point to the file. The file is an archive; the primary reading experience is in the conversation. Output content (show in full, no trimming): 1. **Session summary**: One-sentence overview 2. **Efficiency score**: Optimizable turns / total turns

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The knowledge persistence step instructs automatic updates to memory, notes, or config without requiring explicit user consent at the time of modification. Persisting session-derived preferences can have long-lived privacy and integrity effects, especially if sensitive habits, project details, or mistaken inferences are stored for future sessions.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The persistence workflow encourages storing session-derived preferences and conventions, but those categories can easily include sensitive user information, internal project practices, or confidential business context. Once written to memory or project notes, that data may be retained longer than intended and reused in later contexts.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.
md
### Step 6: Pending Action List For the following types of improvement suggestions, **do not auto-execute** — list them for user selection: | Action Type | Examples | |------------|---------|

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: The template explicitly supports an 'Auto-executed' action tag, which normalizes the idea that the retrospective process may trigger actions without user confirmation. In an agent skill context, this can lead to unauthorized state changes such as persisting knowledge or modifying workspace artifacts based solely on retrospective analysis, increasing the risk of unintended or over-broad automation.
Content: Scanner excerpt · assets/report_template.md (reported line 44)May include surrounding context.
md
**Recommendation**: What to do in similar future scenarios > **Action tag** (Auto-executed / Pending confirmation / Recommendation only) Dimensions with no findings are omitted entirely — don't output empty sections. -->

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The dedicated 'Auto-Executed Actions' section indicates that the skill is designed to perform actions during retrospective generation, not merely recommend them. In a post-session analysis tool, this is riskier because users may expect reporting only, while the skill may silently carry out changes such as saving data or updating memory.
Content: Scanner excerpt · assets/report_template.md (reported line 49)May include surrounding context.
md
Dimensions with no findings are omitted entirely — don't output empty sections. --> ## Auto-Executed Actions {{AUTO_ACTIONS}}

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 91% confidence
Finding: The comment states that operations may be 'auto-executed during this retrospective' and gives an example of persisting knowledge to a location. This is a concrete indication of autonomous write behavior, which can leak sensitive session content into persistent storage, create privacy issues, or poison future agent behavior if the persisted knowledge is inaccurate or adversarially influenced.
Content: Scanner excerpt · assets/report_template.md (reported line 54)May include surrounding context.
md
{{AUTO_ACTIONS}}

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: By framing auto-executed operations as a normal report component and only requiring 'None' if absent, the template encourages implementations to include side-effecting behavior as part of routine operation. In this skill's context, which analyzes entire AI-assisted sessions, that increases the danger because the source material may contain secrets, prompt injections, or misleading instructions that could be persisted or acted upon automatically.
Content: Scanner excerpt · assets/report_template.md (reported line 56)May include surrounding context.
md
 ## Pending Action List

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: The template explicitly encourages 'Auto-execute if possible' for knowledge persistence, which can cause the agent to write to memory, project docs, or configuration without an explicit user confirmation step. In this skill's context, that creates a real risk of silently persisting incorrect, sensitive, or manipulation-influenced information across future sessions, amplifying prompt-injection and privacy issues beyond the current conversation.
Content: Scanner excerpt · references/analysis_dimensions.md (reported line 230)May include surrounding context.
Recommendation Template

text
**Knowledge Persistence** [Auto-execute if possible] - Type: Global preference / Project convention / Technical decision - Content: <specific information to persist> - Suggested location: <where to store, adapted to your tool>

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/analysis_dimensions.md (reported line 275)May include surrounding context.
md
| Sequential search | Searching files one by one | Use global/project-wide search | | Trial and error | Multiple modifications to the same spot | Analyze root cause before modifying | | Hand-written one-off scripts | Rewriting analysis scripts for each verification | Encapsulate into reusable automation | | Missing verification | No verification after modification | Verify immediately after changes | | Plan gaps | Plan didn't cover critical constraints | Add technical constraint review step to planning | ### Recommendation Template

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 87% confidence
Finding: The trigger '复盘' is overly broad and can match ordinary conversational use, making accidental activation likely. In context, accidental activation is meaningful because the skill performs whole-session analysis and may write files or persist information, so even a low-severity trigger issue has downstream privacy and integrity implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the assistant to create or append files in the workspace but does not require a clear user-facing warning before modifying project contents. Even if the content is non-executable, unexpected file writes can clutter repositories, leak sensitive session details into tracked files, or violate user expectations around agent autonomy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The examples for global preferences include "Reply in Chinese," which directs a specific language choice. This presents a natural-language locale policy concern because it normalizes forcing a language without indicating user choice or opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

SkillSpector

Vague Triggers

Missing User Warnings

Vague Triggers

Missing User Warnings

Vague Triggers

Vague Triggers

Vague Triggers

Ssd 3

Unbounded Output

Missing User Warnings

Ssd 3

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Autonomous Decision Making

Recommendation Template

Autonomous Decision Making

Overly Broad Trigger

Missing User Warnings

Natural-Language Policy Violations

Static analysis