other
Note
- Location
install.sh:20- Finding
Undisclosed Installation Telemetry Sent to an External Service
- Content
View full analysis
- Remediation
View remediation
Security audit
Loomlensai
Security checks for vulnerabilities and agentic risk
Overview
The skill is not proven malicious, but its installer makes under-disclosed persistent shell changes, sends install telemetry, and lacks the declared executable.
Review this skill before installing. Only run install.sh if you accept a persistent ~/.zshrc PATH change and an install analytics ping; also verify that a legitimate loomlens executable is supplied or installed from a trusted source before using the command.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
install.sh:17- Finding
Persistent Prepending of a User-Writable Directory to PATH
- Content
View full analysis
/dev/null || echo 'export PATH="$HOME/.local/bin:$PATH"' >> "${HOME}/.zshrc" ``` ### Technical Analysis The installer permanently modifies the user's `.zshrc` and places `$HOME/.local/bin` before all existing PATH entries. This directory is writable by the current user and may contain executables installed by unrelated applications. Prepending a user-writable directory creates command-shadowing exposure. If that directory contains a file with the same name as a trusted system command, interactive shells loading `.zshrc` will resolve the user-controlled executable first. The modification is unnecessary for the reviewed package in its current state: the installer creates `$HOME/.local/bin` but does not install the declared `loomlens` executable there. The command also checks only whether the literal text `~/.local/bin` appears anywhere in `.zshrc`; it does not verify that an appropriate PATH configuration already exists. This issue does not independently allow an external attacker to write files into the directory. Exploitation requires the attacker, a compromised package, or another local process to place a malicious executable there under the victim's account. ### Attack Path 1. The user executes `install.sh`. 2. The script appends a persistent PATH declaration to `$HOME/.zshrc`. 3. The user starts a new Zsh session, causing `$HOME/.local/bin` to take precedence over system executable directories. 4. An attacker or compromised user-level package places an executable in `$HOME/.local/bin` with the same name as a commonly invoked command. 5. The user or an automated process invokes that command by name. 6. The shell runs the shadowing executable with the invoking user's privileges. ### Impact Assessment Successful exploitation ...[truncated 482 chars]- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Warning
- Location
package.json:5- Finding
Declared LoomLens Executable Is Missing from the Package
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared purpose is prompt cost estimation, but the detected behavior includes installation/setup actions, modifying .zshrc, and sending network telemetry. This mismatch is dangerous because users may approve the skill expecting a harmless estimator while it changes local shell configuration and transmits data, which can persistently alter the environment and expose sensitive metadata without informed consent.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill advertises shell-capable installation requirements but does not declare any explicit tool scope such as permissions or allowed-tools. That creates an unnecessary trust gap: consumers cannot tell what execution capabilities are intended, and hidden shell use increases the chance of unsafe command execution during install or runtime.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh LOCAL_BIN="${HOME}/.local/bin" echo "Installing ${SKILL_NAME}..." mkdir -p "$OPENCLAW_SKILLS" "$LOCAL_BIN" # Symlink into OpenClaw skills dir ln -sf "$SCRIPT_DIR" "$OPENCLAW_SKILLS/${SKILL_NAME}"
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script silently appends to the user's ~/.zshrc to modify PATH without warning or confirmation. Persistent shell configuration changes are sensitive because they alter future command resolution and user environment beyond the immediate installation, which is not clearly justified by the skill's stated purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The install script modifies a shell startup file without explicit warning or confirmation, creating persistent side effects outside the skill's immediate install location. This is dangerous because users may not realize their shell behavior has been changed, and such changes can affect future sessions and command execution.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The installer makes an unsolicited outbound POST request during installation that is unrelated to the core function of estimating prompt costs. Even though the payload is limited to skill, version, and source, hidden telemetry in an install script violates least surprise and creates privacy and trust concerns, especially because it occurs automatically and in the background.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script sends a network analytics request during installation without clearly warning the user or asking consent. Silent outbound traffic in an installer is a trust and privacy risk, particularly when the skill's advertised purpose does not require contacting a remote analytics endpoint during setup.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The hardcoded remote domain indicates the installer contacts an external service as part of setup. In the context of a local utility skill, this expands the trust boundary unnecessarily and introduces an avoidable dependency on a network endpoint during install.
- Content
sh grep -q '~/.local/bin' "${HOME}/.zshrc" 2>/dev/null || echo 'export PATH="$HOME/.local/bin:$PATH"' >> "${HOME}/.zshrc" # Fire install ping (no auth needed — tracks community installs) curl -s -m 5 -X POST "https://api.signalloomai.com/v1/analytics/install" \ -H "Content-Type: application/json" \ -d "{\"skill\":\"${SKILL_SLUG}\",\"version\":\"${VERSION}\",\"source\":\"clawhub\"}" &
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The hardcoded remote domain indicates the installer contacts an external service as part of setup. In the context of a local utility skill, this expands the trust boundary unnecessarily and introduces an avoidable dependency on a network endpoint during install.
- Content
sh grep -q '~/.local/bin' "${HOME}/.zshrc" 2>/dev/null || echo 'export PATH="$HOME/.local/bin:$PATH"' >> "${HOME}/.zshrc" # Fire install ping (no auth needed — tracks community installs) curl -s -m 5 -X POST "https://api.signalloomai.com/v1/analytics/install" \ -H "Content-Type: application/json" \ -d "{\"skill\":\"${SKILL_SLUG}\",\"version\":\"${VERSION}\",\"source\":\"clawhub\"}" &
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The comment minimizes the analytics behavior by saying it 'only tracks installs,' while the code transmits structured metadata including skill name, version, and source to a remote service. The mismatch between the reassuring comment and the actual network behavior reduces transparency and can mislead reviewers or users about what the installer does.
- Content