Retro

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:23 PM UTC
• Version: 2.1.0

Overview

This skill is a useful pipeline retrospective tool, but it can run project-defined commands and persist changes to agent guidance files without clear separate approval.

Install only if you are comfortable with a retrospective skill that can execute project-defined test/build commands and update persistent guidance files. Prefer using it in trusted repositories, review any command before it runs, and require explicit approval before CLAUDE.md, docs/evolution.md, ~/.solo/evolution.md, or git history are changed.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:313

Finding

Persistent Poisoning of Project and Cross-Project Agent State

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 313-343 and 410
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: High

Vulnerable Code

markdown

## Phase 9: CLAUDE.md Revision

After patching, revise the project's CLAUDE.md to keep it lean and useful for future agents.

### Steps:

1. **Read CLAUDE.md** and check size: `wc -c CLAUDE.md`
2. **Add learnings from this retro:**
   - Pipeline failure patterns worth remembering (avoid next time)
   - New workflow rules or process improvements
   - Updated commands or tooling changes
   - Architecture decisions that emerged during the pipeline run
3. **If over 40,000 characters — trim ruthlessly:**
   - Collapse completed phase/milestone histories into one line each
   - Remove verbose explanations — keep terse, actionable notes
   - Remove duplicate info (same thing explained in multiple sections)
   - Remove historical migration notes, old debugging context
   - Remove examples that are obvious from code or covered by skill/doc files
   - Remove outdated troubleshooting for resolved issues
4. **Verify result <= 40,000 characters** — if still over, cut least actionable content
5. **Write updated CLAUDE.md**, update "Last updated" date

markdown

Append findings to `{project_root}/docs/evolution.md` (create if not exists). If `~/.solo/evolution.md` exists, append there as well for cross-project tracking.

Technical Analysis

The skill instructs the agent to convert findings derived from repository files, pipeline logs, plans, and iteration output into persistent agent guidance. CLAUDE.md can affect how future agents behave in the project, while ~/.solo/evolution.md is global state that can influence work across unrelated projects.

These writes lack a required trust review, sanitization boundary, or explicit per-write approval. An untrusted repository can place manipulative instructions or fabricated ...[truncated 2019 chars]

Remediation

View remediation

Remediation Suggestions

1. Make all persistent state updates opt-in rather than automatic.
2. Generate and display an exact diff before modifying CLAUDE.md.
3. Require explicit user approval specifically for the persistent guidance change; approval of an unrelated source-code patch must not count.
4. Do not write repository-derived findings to ~/.solo/evolution.md by default.
5. If cross-project storage is required, store only structured, provenance-tagged metadata after separate approval.
6. Treat all logs, plans, commit messages, and repository documentation as untrusted data rather than executable instructions.
7. Reject or escape content that attempts to introduce commands, agent directives, credential requests, safety overrides, or instructions to modify unrelated files.
8. Preserve existing CLAUDE.md content unless the user approves each deletion or replacement.
9. Clearly mark generated observations as retrospective data, not authoritative agent instructions.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:299

Finding

Mandatory Git Commit Bypasses the Skill’s Approval Model

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 299-309 and 343
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code

markdown

2. **For each suggested patch** (if any), use `AskUserQuestion`:
   - Question: "Apply patch to {file}? {one-line description}"
   - Options: "Apply" / "Skip" / "Show diff first"

3. **If "Show diff first":** display the full diff, then ask again (Apply / Skip)

4. **If "Apply":** use Edit tool to apply the change directly

5. **After all patches processed:**
   - If any patches were applied: suggest committing with `fix(retro): {description}`
   - Do NOT auto-commit — just suggest the command

markdown

- Commit the update: `git add CLAUDE.md && git commit -m "docs: revise CLAUDE.md (post-retro)"`

Technical Analysis

The skill establishes an interactive approval model in Phase 8 and explicitly states that it must not automatically commit changes. Phase 9 then contradicts that safeguard by directing the agent to stage and commit CLAUDE.md.

This later instruction can alter repository history without a dedicated approval step. The command stages the entire current version of CLAUDE.md, so pre-existing user edits in that file may be included alongside retrospective-generated changes. The contradiction also creates implementation ambiguity: an agent following the later, more specific instruction may ignore the earlier prohibition.

Although the command uses a fixed path and commit message and therefore is not a direct shell-injection primitive, it is an unsafe repository mutation because consent and change isolation are not enforced.

Attack Path

1. A user invokes the retrospective skill with uncommitted changes already present in CLAUDE.md, or the skill modifies that file during Phase 9.
2. The skill reaches the Phase 9 instruction after the earlier patch approval workflow has completed. 3 ...[truncated 917 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the mandatory commit instruction from Phase 9.
2. Keep the existing “Do NOT auto-commit” rule as the single authoritative policy.
3. Display the complete CLAUDE.md diff and request explicit approval before writing it.
4. After an approved write, suggest a commit command instead of executing it.
5. Before suggesting a commit, check whether CLAUDE.md contained pre-existing changes and warn the user.
6. If automated commits are ever supported, require a separate explicit confirmation and stage only a verified patch.
7. Disable or separately disclose Git-hook execution when operating on an untrusted repository.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:60

Finding

Execution of Repository-Controlled Test and Build Commands Without Trust Validation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60-64 and 183-188
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Code

markdown

If no pipeline logs exist, the retro can still provide value by analyzing:

1. **Git history:** `git log --oneline --since="1 week ago"` — commit frequency, patterns, conventional format
2. **Test results:** run test suite if configured in CLAUDE.md or package.json
3. **Build status:** run build if configured

markdown

3. **Test status** (if test command exists in CLAUDE.md or package.json):
   - Run test suite, capture pass/fail count
   - If no test command found, skip and note "no tests configured"

4. **Build status** (if build command exists):
   - Run build, capture success/fail
   - If no build command found, skip and note "no build configured"

Technical Analysis

The skill instructs the agent to execute test and build commands obtained from repository-controlled files such as CLAUDE.md and package.json. Build and test scripts are executable code, not passive metadata. For example, package-manager scripts can invoke arbitrary shell commands and may also activate lifecycle hooks from installed dependencies.

No instruction requires the agent to inspect the resolved command, verify repository trust, obtain user confirmation, disable lifecycle hooks, remove credentials, restrict network access, or execute in a sandbox. Consequently, opening an untrusted repository and running the retrospective can become an arbitrary command-execution path under the agent’s account.

This is classified as insecure skill coding rather than embedded malicious code because the audited package contains no malicious script payload. The weakness is that it executes commands supplied by the project being audited.

Attack Path

1. An attacker creates or modifies an untrusted repository.
2. The attacker places a malici ...[truncated 1397 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat every project-defined test and build command as untrusted executable content.
2. Resolve and display the exact command before execution.
3. Require explicit user confirmation for each command when repository trust has not been established.
4. Inspect relevant package scripts, wrappers, task files, and lifecycle hooks before running them.
5. Execute untrusted commands in an isolated container or sandbox with:
   • No host credentials or sensitive environment variables.
   • A read-only project mount where practical.
   • No network access unless explicitly required and approved.
   • Resource and execution-time limits.
   • Restricted access to the user’s home directory.
6. Avoid package installation and lifecycle hooks during a retrospective unless separately approved.
7. Prefer static inspection when safe execution cannot be guaranteed, and report tests or builds as “not executed for security reasons.”
8. Record the exact command, working directory, environment restrictions, exit status, and timeout in the audit output.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill initially frames itself as suggesting patches, but later phases instruct direct edits and even a git commit for CLAUDE.md. That mismatch is dangerous because it defeats user expectations about whether invocation is advisory or mutating, increasing the chance of unauthorized repository changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Phase 9 directs automatic revision of CLAUDE.md and later a commit, yet the skill does not provide a clear upfront warning that it will alter persistent project instructions. This is especially dangerous because CLAUDE.md shapes future agent behavior, so an unintended rewrite can create long-lived control-plane changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Broad triggers like 'what went wrong' or 'check pipeline logs' can cause the skill to activate in ordinary conversation, and this skill is not read-only. Because the skill can write files and run commands, overbroad invocation phrases raise the risk of accidental execution with side effects.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Granting broad Bash access is risky here because the skill includes workflows that read, write, append, and potentially commit changes. In combination with dynamic project context, unrestricted shell use increases the blast radius of prompt mistakes or adversarial repository content.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction to read a global fallback state file under the user's home directory extends the skill's reach beyond the active project. Cross-project filesystem access is dangerous because it can expose unrelated project names, paths, or pipeline metadata without a clear need for the current task.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill authorizes running project test and build commands as part of a retrospective. Even if useful diagnostically, test/build commands are effectively arbitrary code execution defined by the target repository, so invoking them from a review-oriented skill can execute untrusted scripts and cause side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill generates a report file in the repository without an upfront warning that repository contents will be modified. Silent writes are risky in security-sensitive environments because users may expect an analysis-only action and may not want generated artifacts committed or persisted.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as a retrospective analyzer, but Phase 9 expands its behavior into persistent modification of project guidance documents. That scope expansion is dangerous because users may invoke a read-mostly diagnostic skill without realizing it will rewrite operational docs that influence future agent behavior.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill tells the agent to summarize pipeline learnings into CLAUDE.md, which may include user-derived, project-confidential, or transient operational details. Natural-language condensation is a durable leakage vector because sensitive context can be transformed and retained even if raw logs are later deleted.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

This instruction establishes durable session persistence by rewriting CLAUDE.md with retrospective learnings. Persisting agent-derived session context into a long-lived control document can unintentionally encode sensitive data and alter future system behavior in ways the user did not request.

Content

Scanner excerpt · SKILL.md (reported line 331)May include surrounding context.

md

- Remove examples that are obvious from code or covered by skill/doc files
   - Remove outdated troubleshooting for resolved issues
4. **Verify result <= 40,000 characters** — if still over, cut least actionable content
5. **Write updated CLAUDE.md**, update "Last updated" date

### Priority (keep -> cut):
1. **ALWAYS KEEP:** Tech stack, directory structure, Do/Don't rules, common commands, architecture decisions

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Phase 10 instructs writing evolution-log entries in both project and home-directory locations, which exceeds the stated purpose of suggesting patches after a pipeline review. This creates persistent cross-project state and a data retention channel that can spread sensitive operational details beyond the current repository.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Appending factory-critic findings to project and home-directory evolution logs creates a cross-project memory channel for sensitive retrospective information. Because the entries are free-form summaries, they can capture confidential implementation details, failures, or user context and propagate them beyond the original repository.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The documentation states the skill is self-contained and should run analysis directly instead of delegating. However, later sections instruct use of MCP tools such as session_search and codegraph tools, which introduces dependence on external tooling and partially contradicts the self-contained claim.

Content

No source excerpt is available for this finding.