taskforce-loop-engineering

• Outcome: Pass
• Latest audit: Sep 19, 2026 · 10:45 AM UTC
• Version: 0.15.19

Overview

This skill is a disclosed loop/task orchestration helper with gated installation and persistence, but users should review the npm package and systemd/dashboard scope before enabling it.

Install only in a workspace where you want durable loop orchestration. Prefer pinning or otherwise verifying the npm package version, review the generated install plan before using --confirm-install, keep the dashboard on localhost unless Tailnet ACLs are acceptable, and confirm scheduler/service setup only after a manual smoke test passes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Ae1

High

• Category: analysis-evasion

Content

A skill installation may provide only this `SKILL.md`; it does **not** prove that the Loop Engineering CLI or an OpenClaw/Hermes integration is installed. Befor

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The skill recommends `npx -p taskforce-loop-engineering loop-engineering --help` without pinning an exact package version. This creates a supply-chain risk because execution will fetch whatever version is current at invocation time, allowing unexpected or malicious upstream package changes to be executed in the operator environment.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Hermes Agent Integration

The core CLI is platform-neutral, but Hermes conversation routing requires its own dispatcher and notifier. Generate a plan and verify its installation confirmation summary identifies Hermes, the absolute Hermes CLI path, intended workspace and queue, systemd scheduler, source-bound notification routing, and `writes enabled: no (plan only)`. If any field identifies the wrong platform or destination, stop. Confirm installation only after that review, then run the read-only doctor and disposable smoke:

```bash
loop-engineering-hermes-install \

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.