Security audit

Loop Anything Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed multi-reviewer workflow; the main risks are cost, sensitive-content handling by subagents, and install/validation caveats rather than hidden malicious behavior.

Install through ClawHub or a trusted skill installer rather than copying a mutable raw GitHub file into a session. Use the skill deliberately on artifacts you are comfortable sending to subagents, expect higher token/cost usage, and treat PASS 120 as a review aid rather than a guarantee, especially because the validator has mechanical coverage limits.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/validate_loop_review.py:103
Finding: Final Review Validation Does Not Enforce One-to-One Facet Coverage
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 85% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · templates/reviewer-packet.md (reported line 36)May include surrounding context.
md
{{EVIDENCE_OR_NONE}} Do not assume context beyond this packet. Do not judge other facets except where they affect your mission. Return PASS only if you have zero remaining reservations about this facet. Score: 120 is the only passing score. Output format: use the fields and rules defined in templates/reviewer-output.md

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 15)May include surrounding context.
md
--- You asked AI to write something important. It came back looking reasonable. You said "looks good." Three weeks later you realize it missed something obvious.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 83)May include surrounding context.
text
Please run: git clone https://github.com/Ariesshin/loop-anything-skill ~/.claude/skills/loop-anything-skill

→ Your agent clones the repo into Claude Code's global skills directory. The skill activates automatically — Claude Code reads your request and loads the skill when it's relevant, no manual trigger needed. For project-local install, use .claude/skills/loop-anything-skill instead.

Codex / OpenCode

text

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README says the skill 'activates automatically' whenever Claude Code 'reads your request and loads the skill when it's relevant,' but it does not define clear boundaries for relevance or provide exclusion examples. Combined with generic example requests like 'Something about this decision feels off. I can't name it. Loop it,' this creates a vague trigger surface that could overlap with common review requests.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 91% confidence
Finding: The README instructs users on generic platforms to fetch raw remote content from GitHub and then 'read it and follow the workflow described inside.' That creates a supply-chain and prompt-injection risk because the effective behavior of the skill can change remotely after installation, and users are encouraged to trust and execute whatever instructions the fetched file contains.
Content: Scanner excerpt · README.md (reported line 99)May include surrounding context.
Any other platform (including Ollama / LM Studio / local models)

text
Please fetch https://raw.githubusercontent.com/Ariesshin/loop-anything-skill/main/SKILL.md — read it and follow the workflow described inside

→ Works on any platform that can fetch URLs. On web-only platforms (ChatGPT, Claude.ai): open SKILL.md in a browser, select all, copy, then paste it as your first message.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 91% confidence
Finding: The README tells web-only users to open the raw SKILL.md in a browser, copy all of it, and paste it as their first message. This directly increases prompt-injection exposure because untrusted remote text is elevated into the highest-priority conversational context and may alter model behavior in ways the user does not inspect.
Content: Scanner excerpt · README.md (reported line 101)May include surrounding context.
text
Please fetch https://raw.githubusercontent.com/Ariesshin/loop-anything-skill/main/SKILL.md — read it and follow the workflow described inside

→ Works on any platform that can fetch URLs. On web-only platforms (ChatGPT, Claude.ai): open SKILL.md in a browser, select all, copy, then paste it as your first message.

After install, say: "Loop-review this [document / plan / decision] — I need it to be bulletproof." The skill takes it from there.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 219)May include surrounding context.
text
请执行：git clone https://github.com/Ariesshin/loop-anything-skill ~/.claude/skills/loop-anything-skill

→ 克隆到 Claude Code 全局 skills 目录。Skill 会自动激活——Claude Code 读取你的请求时，会在需要时自动加载，无需手动触发。如需项目局部安装，把 ~/.claude/skills/ 换成项目根目录下的 .claude/skills/loop-anything-skill。

Codex / OpenCode / OpenClaw / ClawHub

text

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 219)May include surrounding context.
text
请执行:git clone https://github.com/Ariesshin/loop-anything-skill ~/.claude/skills/loop-anything-skill

→ 克隆到 Claude Code 全局 skills 目录。Skill 会自动激活——Claude Code 读取你的请求时,会在需要时自动加载,无需手动触发。如需项目局部安装,把 ~/.claude/skills/ 换成项目根目录下的 .claude/skills/loop-anything-skill。

Codex / OpenCode / OpenClaw / ClawHub

text

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 90% confidence
Finding: The Chinese section repeats the unsafe pattern of fetching a mutable remote SKILL.md and following its instructions. This preserves the same remote-content trust and prompt-injection risk for Chinese-speaking users.
Content: Scanner excerpt · README.md (reported line 229)May include surrounding context.
其他平台（包括 Ollama / LM Studio / 本地模型）

text
请获取 https://raw.githubusercontent.com/Ariesshin/loop-anything-skill/main/SKILL.md，读取它并按照里面描述的工作流执行

→ 适用于能访问 URL 的平台。ChatGPT / Claude.ai 等网页版无法获取 URL，请用浏览器打开 SKILL.md，全选复制，粘贴为第一条消息。

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 90% confidence
Finding: The Chinese instructions advise copying the raw SKILL.md content into the first message, which grants untrusted remote text maximum influence over the session. That is a meaningful prompt-injection risk even if the repository is benign today, because the remote file can change later.
Content: Scanner excerpt · README.md (reported line 231)May include surrounding context.
text
请获取 https://raw.githubusercontent.com/Ariesshin/loop-anything-skill/main/SKILL.md，读取它并按照里面描述的工作流执行

→ 适用于能访问 URL 的平台。ChatGPT / Claude.ai 等网页版无法获取 URL，请用浏览器打开 SKILL.md，全选复制，粘贴为第一条消息。

安装完成后，说： 「帮我对这份 [文档/方案/决定] 做 Loop 审查，我需要它无懈可击。」 Skill 会自动接管后续流程。

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill instructs the agent to read multiple local files and create or update run artifacts, but it does not declare any explicit tool scope such as allowed file operations. That mismatch can cause an agent platform to grant broader-than-necessary filesystem access by default or make reviewers/users unaware of the skill's actual capabilities.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The default prompt activates the skill for 'this deliverable' and then directs the agent to create multiple subagents and iterate until all pass, without clear boundaries on artifact sensitivity, cost, or permitted actions. In an agentic environment, such a broad default can trigger expansive autonomous behavior on arbitrary user content, increasing the risk of unintended data exposure and resource consumption.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The phrase telling a human to say 'Use Loop Anything on [your deliverable]' is a generic trigger that can match a very wide range of contexts and artifacts. Broad invocation language increases the chance of accidental or inappropriate activation on sensitive inputs, causing unnecessary subagent spawning, file access, or workflow execution without clear user scoping.
Content: No source excerpt is available for this finding.