ClawHub
Back to skill

Security audit

goal-loop

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed workflow supervisor that helps an agent track and verify complex work, with the main caveat that it may create a project checkpoint file.

Install only if you want an agent to use a structured ledger/checkpoint workflow on complex projects. Expect it to read project context and, for larger tasks, create or update PROJECT-CHECKPOINT.md in the project root; avoid using it in sensitive repositories unless that persistent task state is acceptable.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Vague Triggers

High
Confidence
95% confidence
Finding
The skill advertises activation for very broad, common phrases like complete, implement, fix, continue, and validate across many domains. That can cause unintended invocation on ordinary tasks, pulling in heavy supervisory behavior and file-writing side effects the user did not specifically request.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The README presents all user-facing instructions in Chinese and does not indicate that the user can choose another language. Per the policy category, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The compatibility, metadata description, and argument hint are written in Chinese, and the trigger examples also include Chinese-only phrases such as '继续之前项目' and '继续'. This introduces a language/locale bias without explicitly offering the user a language choice or justifying the locale constraint as region-specific.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The 'Decide whether to use Goal Loop' section uses subjective conditions such as 'high cost of dropping a requirement' and 'non-trivial' work, leaving activation to broad agent interpretation. Ambiguous self-selection increases the chance the skill takes over workflows unexpectedly or persists state when the user did not intend that behavior.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
**Inspect** — before acting: current goal, the user's latest message, project
`AGENTS.md` / `QWEN.md` / spec / README, `PROJECT-CHECKPOINT.md` if present,
current file state, prior results, the last validation outcome. Never restart
from scratch without checking; never redo already-VERIFIED work.

**Select** — pick the highest-priority unresolved ledger item (P0 first).
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to automatically create and maintain PROJECT-CHECKPOINT.md in the project root, but that side effect is not prominently disclosed in the user-facing description. Hidden persistent writes can leak sensitive task context into the workspace, modify repositories unexpectedly, and surprise users who did not consent to state files.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
agents or deliverables, has complex acceptance, will be iterated later, or where
a dropped requirement is expensive.

**Automatic maintenance** (never ask the user to maintain it):
- First complex task in a project with no checkpoint: create it, extract goal,
  build the ledger, fill Definition of Done, constraints, `NEXT ACTION`.
- At meaningful phase boundaries update `DONE` / `IN_PROGRESS` / `TODO` /
Confidence
88% confidence
Finding
The instruction to 'never ask the user to maintain it' accompanies automatic creation and updating of a project-root checkpoint file. In context, this grants the skill authority to persist task state autonomously, which can override user expectations around consent, repository cleanliness, and storage of sensitive intermediate context.

Static analysis

No suspicious patterns detected.