taskforce-loop-engineering

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:01 AM UTC
• Version: 0.15.0

Overview

The skill is mostly coherent for managed task loops, but it asks users to install and run an unpinned external CLI that can later manage workers, schedulers, notifications, and workspace changes.

Review the external package and repository before installing. Prefer an exact pinned version or audited commit, avoid global or npx execution in sensitive environments, and only enable OpenClaw/Hermes schedulers and notifications after confirming the workspace, queue, worker identity, and routing destination are correct.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29

Finding

Unpinned External Package Retrieval and Execution

Content

View full analysis

Remediation

View remediation

git verify-commit npm ci ``` 6. Pin the repository to a signed, immutable commit or release tag and document the expected commit hash. Do not execute code directly from a mutable default branch. 7. Review package lifecycle scripts and initially install with lifecycle execution disabled where compatible: ```bash npm ci --ignore-scripts ``` Any required lifecycle script should be audited before being run separately. 8. Execute package inspection and initial verification in a sandbox or container with no production credentials, minimal filesystem access, and restricted network permissions. 9. Add provenance verification, dependency auditing, and lockfile validation to the release process. Regenerate trusted hashes whenever the documented package version changes. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

A skill installation may provide only this `SKILL.md`; it does **not** prove that the Loop Engineering CLI or an OpenClaw/Hermes integration is installed. Befor

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill recommends npx -p taskforce-loop-engineering loop-engineering --help without pinning an exact package version or integrity source. That creates a supply-chain risk because execution depends on whatever package version is current at invocation time, allowing a compromised upstream package or typo-squatted resolution path to run unreviewed code on the host.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

Hermes Agent Integration

The core CLI is platform-neutral, but Hermes conversation routing requires its own dispatcher and notifier. Generate a plan and verify its installation confirmation summary identifies Hermes, the absolute Hermes CLI path, intended workspace and queue, systemd scheduler, source-bound notification routing, and writes enabled: no (plan only). If any field identifies the wrong platform or destination, stop. Confirm installation only after that review, then run the read-only doctor and disposable smoke:

bash

loop-engineering-hermes-install \

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The invocation rules explicitly privilege Chinese and English trigger phrases such as 走 loop and loop engineering, but the document does not state that the skill is limited to those languages or offer alternatives for users in other locales. This is a natural-language policy concern because it imposes a language-specific activation scheme without opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.