retro
Analyzes commit history and work patterns to generate engineering retrospectives, enhancing team performance and code quality.
Install this skill
Security score
The retro skill was audited on Mar 17, 2026 and we found 13 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 345 | ```bash |
Access to hidden dotfiles in home directory
| 21 | _UPD=$(~/.claude/skills/gstack/bin/gstack-update-check 2>/dev/null || .claude/skills/gstack/bin/gstack-update-check 2>/dev/null || true) |
Access to hidden dotfiles in home directory
| 23 | mkdir -p ~/.gstack/sessions |
Access to hidden dotfiles in home directory
| 24 | touch ~/.gstack/sessions/"$PPID" |
Access to hidden dotfiles in home directory
| 25 | _SESSIONS=$(find ~/.gstack/sessions -mmin -120 -type f 2>/dev/null | wc -l | tr -d ' ') |
Access to hidden dotfiles in home directory
| 26 | find ~/.gstack/sessions -mmin +120 -type f -delete 2>/dev/null || true |
Access to hidden dotfiles in home directory
| 27 | _CONTRIB=$(~/.claude/skills/gstack/bin/gstack-config get gstack_contributor 2>/dev/null || true) |
Access to hidden dotfiles in home directory
| 30 | If output shows `UPGRADE_AVAILABLE <old> <new>`: read `~/.claude/skills/gstack/gstack-upgrade/SKILL.md` and follow the "Inline upgrade flow" (auto-upgrade if configured, otherwise AskUserQuestion with |
Access to hidden dotfiles in home directory
| 51 | **To file:** write `~/.gstack/contributor-logs/{slug}.md` with this structure: |
Access to hidden dotfiles in home directory
| 71 | Then run: `mkdir -p ~/.gstack/contributor-logs && open ~/.gstack/contributor-logs/{slug}.md` |
Access to hidden dotfiles in home directory
| 145 | cat ~/.gstack/greptile-history.md 2>/dev/null || true |
Access to hidden dotfiles in home directory
| 182 | **Greptile signal (if history exists):** Read `~/.gstack/greptile-history.md` (fetched in Step 1, command 8). Filter entries within the retro time window by date. Count entries by type: `fix`, `fp`, ` |
Access to hidden dotfiles in home directory
| 393 | **Note:** Only include the `greptile` field if `~/.gstack/greptile-history.md` exists and has entries within the time window. Only include the `backlog` field if `TODOS.md` exists. If either has no da |