Close Loop

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:02 PM UTC
• Version: 2.3.6

Overview

This skill is not hiding executable code, but its default wrap-up flow can commit changes, move files, and write lasting agent memory or rules without strong per-action confirmation.

Use this skill only if you want a wrap-up agent that can actively change your workspace. Prefer dry-run mode, review proposed commits and file moves, and require explicit approval before memory/rule writes, pushes, deploys, or any commit that could include unrelated or sensitive files.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: components/02-phase-1-ship-state.md:1
• Finding: Automatic Repository and Project-State Modification Without Explicit Per-Run Approval## Vulnerability Details **File Location**: `components/02-phase-1-ship-state.md:1-9`; supporting execution policy in `components/01-design-principles.md:9-14` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Instructions `components/02-phase-1-ship-state.md:1-9`: ```markdown ## Phase 1: Ship State 1. Find touched repos and run `git status` in each. 2. If uncommitted changes exist, commit with descriptive messages. 3. If push is allowed by policy, push to remote; otherwise report ready-to-push commands. 4. Validate file placement and naming conventions for files created in this session. 5. Move misplaced document files (`.md`, `.docx`, `.pdf`, `.xlsx`, `.pptx`) to the correct docs location when applicable. 6. Detect deploy scripts/skills and run only if deploy is approved. 7. Reconcile task tracking: close completed items, flag stale or orphaned items. ``` Supporting policy from `components/01-design-principles.md:9-14`: ```markdown ## Execution policy - Default is execution mode: perform actions directly. - Ask exactly one minimal question only when blocked by unclear irreversible operations. - Only push, deploy, or publish externally when explicitly requested in this session or preapproved by project policy. - Support `dry-run` mode to compute all actions and memory writes without side effects. ``` ### Technical Analysis The Skill defaults to direct execution and instructs the agent to commit all detected uncommitted changes, move documents, and modify task-tracking state. Explicit authorization gates exist for push, deployment, and publication, but equivalent gates are absent for commits, file relocation, and task closure. Repository discovery based on “touched repos” and commit selection based only on the presence of uncommitted changes do not establish that every changed file belongs to the current task. A working tree can contain ...[truncated 2502 chars]
• Remediation: ## Remediation Suggestions 1. Make `dry-run` the default mode. Require an explicit `execute` request before performing any workspace mutation. 2. Before committing, present: - The repository path. - The exact files to be staged. - A staged diff summary. - The proposed commit message. - Any files excluded because they are unrelated or potentially sensitive. 3. Require explicit user approval for the proposed commit rather than treating a generic wrap-up request as commit authorization. 4. Restrict commit candidates to files demonstrably changed during the current task. Do not automatically include pre-existing working-tree changes. 5. Scan proposed commits for secrets, private keys, environment files, credentials, and local configuration before staging. 6. Convert document relocation into a proposed move plan. Require approval for each source and destination pair, and use version-control-aware move operations where applicable. 7. Convert task closure and cleanup into recommendations unless the user explicitly approves the listed task identifiers and state transitions. 8. Record rollback instructions for every applied action, including commit hashes, reverse file moves, and task-state restoration steps. 9. Preserve the existing explicit gates for push and deployment, and ensure approval applies to a specific remote, branch, target, and command.

T02 · Agent Memory Poisoning

Error

• Location: components/04-phase-3-4-and-output.md:10
• Finding: Session-Derived Content Can Be Persisted Into Future Agent Instructions## Vulnerability Details **File Location**: `components/04-phase-3-4-and-output.md:10-15`; supporting persistence rules in `components/03-phase-2-memory.md:31-44` **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: High ### Vulnerable Instructions `components/04-phase-3-4-and-output.md:10-15`: ```markdown Apply low-risk improvements immediately: 1. Update relevant `CLAUDE.md` or scoped rule files. 2. Save stable insights to memory with confidence labels. 3. Draft skill or hook specs for repetitive patterns. 4. Commit improvement changes separately from feature commits when possible. ``` Supporting persistence targets and filters from `components/03-phase-2-memory.md:31-44`: ```markdown ### Classification targets | Type | Meaning | Default target | |---|---|---| | Working | Short-lived execution context | Do not persist after report | | Episodic | What happened in this session | Auto memory | | Semantic | Stable project facts and conventions | `CLAUDE.md` or project rules | | Procedural | Reusable workflow patterns | `.claude/rules/` or skill docs | ### Write filter `score = novelty + stability + reuse + evidence - sensitivity` - Each factor is scored `0..2`. - Persist only when `score >= 5`. - Require provenance for every persisted item: source step, evidence snippet, confidence. - Deduplicate against existing memory before writing. - Never persist secrets, tokens, private keys, or personal sensitive data. ``` ### Technical Analysis The Skill extracts candidate memories from the transcript, command output, and diffs, then allows semantic or procedural candidates to be written into `CLAUDE.md`, project rules, `.claude/rules/`, or Skill documentation. These files can influence how agents interpret and execute future requests, so they are not merely passive session notes; they are part of the persistent instruction boundary. The Skill contains useful controls, including ...[truncated 3186 chars]
• Remediation: ## Remediation Suggestions 1. Prohibit automatic writes from session-derived content to `CLAUDE.md`, `.claude/rules/`, project rules, Skill instructions, hooks, or equivalent agent-control files. 2. Generate a proposed memory or rule patch and require explicit human approval before applying it. 3. Separate passive factual memory from executable or imperative instructions: - Facts may be proposed for a data-only memory store. - Procedures and behavioral rules must undergo a stricter review path. - Session content must never directly become a higher-priority instruction. 4. Introduce source trust levels. Permit automatic consideration only for authenticated first-party sources, and quarantine candidates originating from repository prose, issue text, generated output, external content, or user-controlled fixtures. 5. Treat provenance as metadata rather than proof of trust. Record the complete source excerpt, source hash, author or origin where available, and the transformation used to create the candidate. 6. Add an instruction-content detector that rejects candidates containing commands, tool directives, approval bypasses, credential requests, remote URLs, or attempts to redefine safety policy. 7. Require two independent trusted sources before a procedural item can be proposed for persistence; confidence scoring alone should not authorize a write. 8. Store approved memories in a structured data file that cannot itself issue agent instructions. Render them as untrusted context when read. 9. Maintain append-only audit records and rollback metadata for every memory change, including the previous content, approving actor, timestamp, evidence, and destination. 10. Prevent automatic commits of memory and rule changes. Review and approve them separately from feature work. 11. Add tests using adversarial transcripts, malicious repository documents, poisoned command output, and conflicting memories to verify that injected procedural conten ...[truncated 14 chars]

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger phrases are generic conversational commands such as 'wrap up' and 'end session', which can plausibly appear in ordinary dialogue and unintentionally activate the skill. In an agent setting, broad activation increases the chance of accidental execution of end-of-session workflows that may alter memory state or initiate gated operational steps.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- High signal memory only
- Deterministic end-of-session behavior
- Minimal irreversible actions without approval
- Clear output contract with evidence and confidence labels
- Memory security against poisoning/injection patterns

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs committing local changes and potentially pushing them to a remote repository as part of a close-loop workflow. Those actions modify user data and can transmit data externally, which exceeds a passive end-of-session summary/preparation role unless there is an explicit, narrowly scoped authorization and confirmation gate.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: These instructions direct the agent to commit changes and move files without an explicit warning that they will modify user data. The lack of a clear consent boundary increases the chance of unintended irreversible changes, especially in an end-of-session workflow where the user may expect summarization rather than mutation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Pushing to a remote repository can exfiltrate source code, documents, secrets, or sensitive metadata to an external service. Because the instruction lacks a prominent warning and relies only on vague policy allowance, it creates a meaningful risk of unauthorized external data transmission.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Running deploy scripts can trigger wide-ranging system and production changes, including publishing artifacts, altering infrastructure, or executing arbitrary code paths. Even though the text says to run them only if deploy is approved, it still lacks an explicit warning about the operational impact and does not define a strong approval or verification process.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: Automatically moving document files based on inferred placement rules can alter or break a user's workspace, references, and project organization without consent. In a close-loop skill, this behavior is only weakly tied to the stated purpose and becomes risky because it performs filesystem mutations on potentially broad file types.

Static analysis

No suspicious patterns detected.