ClawHub
Back to skill

Security audit

Looper

Security checks across malware telemetry and agentic risk

Overview

Looper matches its stated automation purpose, but it can create persistent workflows that directly change GitHub repositories, publish social posts, manage API keys, and run with broad delegated authority.

Review before installing. Use this only if you trust Looper with the target repositories, social accounts, prompts, and credentials. Prefer propose or notify mode, set explicit run limits, avoid putting third-party API keys in prompt fields when possible, confirm every create/update/delete/run action, and rotate any Looper or posting keys if exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (20)

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill documents shell-based network operations but does not declare corresponding permissions, creating a capability/permission mismatch. This is dangerous because an agent may be allowed to execute external API calls, create accounts, manage automation, and affect third-party systems without transparent user consent or proper policy enforcement.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The stated purpose focuses on content/code/social automation, but the documented behavior also includes account lifecycle actions, tenant/account information retrieval, GitHub connection checks, loop administration, and operational control. This mismatch is dangerous because users and policy engines may underestimate the breadth of authority granted to the skill, leading to unauthorized management actions and exposure of connected services.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The workflow instructs the agent to sign up for accounts and create/manage API credentials, which expands the skill from automation into identity and secret management. This is dangerous because autonomous account creation and credential provisioning can create untracked external assets, increase secret sprawl, and enable persistent third-party access beyond the user's expectations.

Context-Inappropriate Capability

Low
Confidence
83% confidence
Finding
The skill exposes billing/subscription upgrade capability even though billing management is not central to the advertised automation function. This is dangerous because an agent with this guidance could initiate paid plan changes or subscription workflows, creating financial impact without sufficiently clear user awareness.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill describes automated modes that can directly commit to repositories and publish generated content on a schedule, but it does not prominently warn about these side effects. This is dangerous because users may enable autonomous operation without understanding that the skill can make persistent external changes repeatedly, including publishing low-quality or harmful content and altering source repositories.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation includes a delete operation for loops without labeling it as destructive or irreversible. This is dangerous because an agent or user may invoke deletion casually, causing loss of scheduled workflows, configuration, and operational continuity with limited chance of recovery.

External Transmission

Medium
Category
Data Exfiltration
Content
### 1. Sign Up

```bash
curl -X POST https://api.looper.bot/api/signup \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "your-password"}'
```
Confidence
90% confidence
Finding
The signup example transmits email and password to an external service and returns an admin key, expanding the agent's trust boundary and creating a new privileged credential. In this skill context, that is more dangerous because the credential can later be used to manage loops, connected GitHub targets, and publishing behavior, making secret handling and user consent critical.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Get OAuth URL
curl -s https://api.looper.bot/api/github/connect \
  -H "Authorization: Bearer <key>"

# Visit the returned URL to authorize, then check status:
Confidence
85% confidence
Finding
The GitHub connect flow involves contacting an external service to obtain an OAuth URL and establish repository-linked authorization. In this context, that is security-sensitive because it can bridge the Looper account to source-control assets, enabling automated repository actions if the connection is approved.

External Transmission

Medium
Category
Data Exfiltration
Content
### 1. Sign Up

```bash
curl -X POST https://api.looper.bot/api/signup \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "your-password"}'
```
Confidence
90% confidence
Finding
The signup example transmits email and password to an external service and returns an admin key, expanding the agent's trust boundary and creating a new privileged credential. In this skill context, that is more dangerous because the credential can later be used to manage loops, connected GitHub targets, and publishing behavior, making secret handling and user consent critical.

External Transmission

Medium
Category
Data Exfiltration
Content
### 2. Login (if you need tenant info later)

```bash
curl -X POST https://api.looper.bot/api/login \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "password": "your-password"}'
```
Confidence
86% confidence
Finding
The login example sends credentials to an external service to retrieve account context, extending the trust boundary and exposing secrets in agent-mediated flows. In this skill context, the authenticated session can reveal tenant information and support subsequent administrative actions, so the operation carries meaningful privacy and control risks.

External Transmission

Medium
Category
Data Exfiltration
Content
Generates and commits blog posts to your GitHub repo on a schedule.

```bash
curl -X POST https://api.looper.bot/api/loops \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
91% confidence
Finding
Creating a loop sends configuration and prompts to an external service that can then generate and commit content to a GitHub repository on a schedule. This is dangerous in context because it establishes persistent automated behavior affecting external assets, and prompts may contain sensitive business context or publishing instructions.

External Transmission

Medium
Category
Data Exfiltration
Content
Reviews your codebase and suggests or applies improvements.

```bash
curl -X POST https://api.looper.bot/api/loops \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
89% confidence
Finding
The Analyze loop transmits repository-targeting configuration and instructs an external service to review and potentially apply code changes. In this context, that is risky because codebase metadata and analysis prompts leave the local environment, and the resulting automation may influence software changes with security consequences.

External Transmission

Medium
Category
Data Exfiltration
Content
Social Kit template ID: `7431b897-396f-4542-8e32-d8d1c5e445a2`

```bash
curl -X POST https://api.looper.bot/api/loops \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
88% confidence
Finding
The Social Kit example sends publishing configuration, target platforms, and an additional API key for another integration to an external service. This is dangerous because it compounds trust by transmitting third-party credentials and enables automated public posting, which can create account takeover, brand, and reputational risks if mishandled.

External Transmission

Medium
Category
Data Exfiltration
Content
### Toggle loop on/off
```bash
curl -X PATCH https://api.looper.bot/api/loops/<loop-id> \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{"enabled": false}'
Confidence
82% confidence
Finding
Toggling loops on or off is an authenticated external state-changing operation that can alter automated behavior. In this context, it is security-relevant because enabling or disabling scheduled automations can affect repository changes, content publishing, and operational workflows without clear user review if invoked by an agent.

External Transmission

Medium
Category
Data Exfiltration
Content
### Trigger a run manually
```bash
curl -X POST https://api.looper.bot/api/loops/<loop-id>/run \
  -H "Authorization: Bearer <key>"
```
Confidence
84% confidence
Finding
Manually triggering a run is a privileged external action that can immediately execute automated code review, content generation, or publishing workflows. In this skill's context, that can cause unreviewed external side effects right away, increasing the risk of accidental commits or public posts.

External Transmission

Medium
Category
Data Exfiltration
Content
### Update loop settings
```bash
curl -X PATCH https://api.looper.bot/api/loops/<loop-id> \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{"schedule": "0 8 * * *", "model": "gpt-4o"}'
Confidence
81% confidence
Finding
Updating loop settings is an authenticated remote write operation that can change schedules, models, and automation behavior. This is risky in context because schedule or model changes may increase cost, alter output quality, or enable more aggressive unattended actions over time.

External Transmission

Medium
Category
Data Exfiltration
Content
### Delete a loop
```bash
curl -X DELETE https://api.looper.bot/api/loops/<loop-id> \
  -H "Authorization: Bearer <key>"
```
Confidence
87% confidence
Finding
Deleting a loop is a destructive external write action that permanently removes an automation configuration. In this context, it is dangerous because it can interrupt business workflows and erase operational setups, especially when combined with agent autonomy and lack of a strong warning.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Get OAuth URL
curl -s https://api.looper.bot/api/github/connect \
  -H "Authorization: Bearer <key>"

# Visit the returned URL to authorize, then check status:
Confidence
85% confidence
Finding
The GitHub connect flow involves contacting an external service to obtain an OAuth URL and establish repository-linked authorization. In this context, that is security-sensitive because it can bridge the Looper account to source-control assets, enabling automated repository actions if the connection is approved.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# List keys (metadata only, not the key itself)
curl -s https://api.looper.bot/api/keys \
  -H "Authorization: Bearer <key>"

# Generate a new key
Confidence
83% confidence
Finding
Listing API keys metadata is an authenticated external action involving credential-management infrastructure. Even without returning secret values, key inventory can reveal privileged integrations and support further administrative operations, making it sensitive in this skill context.

External Transmission

Medium
Category
Data Exfiltration
Content
-H "Authorization: Bearer <key>"

# Generate a new key
curl -X POST https://api.looper.bot/api/keys \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{"name": "CI Key"}'
Confidence
90% confidence
Finding
Generating a new API key is a high-sensitivity external action because it creates fresh credentials that can grant ongoing access to the Looper account. In this context, that enables persistent privileged control over loops, integrations, and possibly connected repositories, making unauthorized or opaque key creation particularly dangerous.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.