ClawHub

looop

Security checks across malware telemetry and agentic risk

Overview

This skill openly automates Claude to edit and commit code, but it does so with permission checks disabled and limited user approval checkpoints.

Install only for trusted repositories and requirements. Run on a disposable branch or copy, use --max-tasks to limit each run, review diffs and .looop logs before relying on the result, and avoid --push until after manual review. Do not include secrets or proprietary content unless you are comfortable sending that context through your local Claude CLI.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
pass

    cmd = 'claude -p --dangerously-skip-permissions --verbose --output-format stream-json'
    process = subprocess.Popen(
        cmd,
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,
Confidence
98% confidence
Finding
process = subprocess.Popen( cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, encoding="utf-8", shell=T

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
---
name: looop
description: Claude Automated Development Toolkit - Decompose requirements documents, single files, or inline text into detailed task lists and automatically execute in loops until project completion
requires:
  - claude-cli: Requires local Claude CLI installation
  - git: Modifies git repository (commits changes)
Confidence
91% confidence
Finding
automatically execute

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
The script will first check if `<src_dir>/.looop/tasks.json` exists:

- Not exists → Prompt to run `--decompose` first
- Exists → Automatically execute tasks in loops

Execution process:
Confidence
95% confidence
Finding
Automatically execute

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal