Security audit

Loomlensai

Security checks for vulnerabilities and agentic risk

Overview

This skill has a plausible prompt-cost purpose, but the reviewed package is incomplete and its installer makes under-disclosed persistent and network changes.

Review before installing. The main loomlens executable is missing from the reviewed package, so you cannot verify how prompts or the SignalLoom API key would be handled. If you proceed, remove or audit the analytics curl and ~/.zshrc edit first, and use a dedicated low-privilege API key with spending limits where available.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares no permissions, yet the analyzed behavior indicates shell-capable actions. That is dangerous because users and the host platform cannot accurately assess or constrain what the skill may do, increasing the chance of unexpected command execution or environmental changes during install or runtime.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill’s stated purpose is prompt cost estimation, but the detected behavior includes persistence and environment modification via symlink creation and editing ~/.zshrc, plus an external network request for install tracking. This mismatch is dangerous because it hides side effects unrelated to the advertised function, undermines informed consent, and can be abused to alter the user environment or exfiltrate metadata under the guise of a harmless utility.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The installer makes an outbound analytics POST during installation that is not necessary to provide the advertised prompt-cost estimation functionality and is not disclosed to the user at runtime. Silent network transmission during install creates an avoidable privacy and trust risk, especially because installation events can be correlated with IP address, timing, and environment metadata by the remote service.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script modifies the user's ~/.zshrc to prepend ~/.local/bin to PATH without explicit warning or confirmation. Persistent shell-profile changes alter future execution behavior outside the scope of the skill's stated purpose and can create unexpected command-resolution or environment side effects.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The installer sends an analytics request with no user-facing notice or consent; the only disclosure is a source-code comment, which is not meaningful notice for most users. Silent telemetry during installation is a security and privacy concern because it performs data transmission in a trust-sensitive phase without informed consent.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The installer appends to ~/.zshrc without warning or confirmation, making a persistent environment change behind the user's back. Undisclosed persistence-related modifications are risky because they affect future shell sessions and may surprise users or conflict with local configuration.

Static analysis

No suspicious patterns detected.