Security audit
Security checks for vulnerabilities and agentic risk
The skill matches its stated retrospective purpose, but it automatically creates persistent per-person work-pattern records without clear consent or retention controls.
Review this carefully before installing in a work repository. It can be useful for retrospectives, but it records named contributor activity, coding-time patterns, streaks, productivity metrics, and growth areas to local memory files. Install only if the team is comfortable with that local historical record, and consider adding an opt-in save step, anonymization, and retention/deletion rules.
The description says to use the skill when asked for 'weekly retro, what shipped this week, or engineering retrospective.' Phrases like 'what shipped this week' are broad and could match ordinary conversation outside the intended retrospective workflow, with no negative examples or tighter activation constraints.
The skill persists retrospective snapshots to memory/retro-YYYY-MM-DD.json, which can store contributor names, per-person productivity metrics, streaks, time patterns, and other behavioral data without any explicit consent, retention limits, or minimization. This creates a privacy risk and a durable local record of employee profiling that may be exposed to other tools, users, or later prompts.
The skill requires saving retrospective history to disk and does so without any user-facing warning that contributor analysis, work habits, and potentially identifying information will be retained. Because the saved history is specifically intended for future comparisons, it increases the duration and reach of sensitive workforce analytics beyond the immediate user request.
The skill reads git config user.name and git config user.email and treats that identity as the current reader for personalized analysis. While this is relevant to the feature, it collects personal identifiers from the local environment and uses them to produce individualized profiling, which can surprise users and increase privacy sensitivity when combined with persistent storage and teammate comparison.
No suspicious patterns detected.
