ClawHub
Back to skill

Security audit

autonomous-loops

Security checks for vulnerabilities and agentic risk

Overview

This is a high-power but transparent guide for automating coding agents, with the main risks disclosed and bounded by consent, dry-run, budget, and review guidance.

Install only if you intentionally want guidance for autonomous coding-agent loops. Use it on repositories you own or administer, start in dry-run/no-commit mode, use least-privileged tokens, set hard run/cost/time limits, keep session and notes files out of git, and manually review any PR or merge action.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (32)

Context Leakage

High
Category
Data Exfiltration
Content
**Why this design:**

- **No full diffs in agent prompts.** Full diffs of internal code, paths, and structure are exactly the kind of context that should not be amplified through automated loops. The previous "capture context" pattern was both an exfiltration risk and a context-bloat trap.
- **Human in the loop at the high-leverage point.** Reordering a DAG is one of the cheapest, highest-impact interventions. It's the right place for human judgment.
- **Bounded recovery.** No retry storm, no context accumulation, no chance for the loop to "discover" that capturing more context helps.
Confidence
75% confidence
Finding
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

External Model or Provider Selection

High
Category
Excessive Agency
Content
```bash
# Step 1: Implement (be thorough)
claude -p "Implement the feature with full TDD. Be thorough with tests."

# Step 2: Clean up (separate context, focused cleanup)
claude -p "Review all changes. Remove:
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
claude -p "Implement the feature with full TDD. Be thorough with tests."

# Step 2: Clean up (separate context, focused cleanup)
claude -p "Review all changes. Remove:
- Tests that verify language/framework behavior (not business logic)
- Redundant type checks the type system already enforces
- Overly defensive error handling for impossible states
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
```bash
for feature in "${features[@]}"; do
  # Implement
  claude -p "Implement $feature with TDD."

  # De-sloppify (review only, no network writes)
  claude -p "Cleanup: review changes, remove test/code slop, run tests."
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
claude -p "Implement $feature with TDD."

  # De-sloppify (review only, no network writes)
  claude -p "Cleanup: review changes, remove test/code slop, run tests."

  # Verify
  claude -p "Build + lint + tests. Fix failures."
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
claude -p "Cleanup: review changes, remove test/code slop, run tests."

  # Verify
  claude -p "Build + lint + tests. Fix failures."

  # Commit
  claude -p "Commit: feat: add $feature"
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
claude -p "Build + lint + tests. Fix failures."

  # Commit
  claude -p "Commit: feat: add $feature"
done
```
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
### Phase 1: Spec Analysis + Redaction

```bash
claude -p "Read /specs/component.md. Understand what component to generate."
```

Before passing the spec to agents in Phase 4, the orchestrator runs a redaction pass:
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
### Phase 3: Plan Creative Directions

```bash
claude -p "
The spec: {REDACTED spec text}
Existing iterations: {list of directories}
Plan 5 UNIQUE creative directions for implementing this, each different theme.
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
### Phase 3: Plan Creative Directions

```bash
claude -p "
The spec: {REDACTED spec text}
Existing iterations: {list of directories}
Plan 5 UNIQUE creative directions for implementing this, each different theme.
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
### Phase 3: Plan Creative Directions

```bash
claude -p "
The spec: {REDACTED spec text}
Existing iterations: {list of directories}
Plan 5 UNIQUE creative directions for implementing this, each different theme.
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
set -e  # Exit on first failure

# Step 1: Implement
claude -p "Read docs/spec.md. Implement OAuth2 login in src/auth/. Write tests first (TDD)."

# Step 2: Clean up
claude -p "Review changes. Remove unnecessary test assertions and overly defensive checks. Keep business logic tests. Run tests after cleanup."
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
claude -p "Read docs/spec.md. Implement OAuth2 login in src/auth/. Write tests first (TDD)."

# Step 2: Clean up
claude -p "Review changes. Remove unnecessary test assertions and overly defensive checks. Keep business logic tests. Run tests after cleanup."

# Step 3: Verify
claude -p "Run full build, lint, type check, test suite. Fix any failures."
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
claude -p "Review changes. Remove unnecessary test assertions and overly defensive checks. Keep business logic tests. Run tests after cleanup."

# Step 3: Verify
claude -p "Run full build, lint, type check, test suite. Fix any failures."

# Step 4: Commit
claude -p "Create conventional commit for all changes. Message: 'feat: add OAuth2 login'"
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
claude -p "Run full build, lint, type check, test suite. Fix any failures."

# Step 4: Commit
claude -p "Create conventional commit for all changes. Message: 'feat: add OAuth2 login'"
```

## Key Design
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
```bash
# Research with strong model
claude -p --model opus "Analyze the codebase architecture and write a plan..."

# Implement with capable model
claude -p "Implement according to the plan..."
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
claude -p --model opus "Analyze the codebase architecture and write a plan..."

# Implement with capable model
claude -p "Implement according to the plan..."

# Review with strong model
claude -p --model opus "Review for security issues, race conditions, edge cases..."
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
claude -p "Implement according to the plan..."

# Review with strong model
claude -p --model opus "Review for security issues, race conditions, edge cases..."
```

## Context Bridge: SHARED_TASK_NOTES.md
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
Each step reads this file and updates it:

```bash
claude -p "Read SHARED_TASK_NOTES.md. Work on the current 'Next Steps'. Update the progress section when done."
```

## Environment Context
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
EOF

# Pass reference to file
claude -p "Read .claude-context.md for priorities. Work through them in order."

# Clean up
rm .claude-context.md
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
```bash
# Read-only analysis
claude -p --allowedTools "Read,Grep,Glob" "Audit this codebase for security vulnerabilities..."

# Implementation only
claude -p --allowedTools "Read,Write,Edit,Bash" "Implement the fixes from audit.md..."
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High
Category
Excessive Agency
Content
claude -p --allowedTools "Read,Grep,Glob" "Audit this codebase for security vulnerabilities..."

# Implementation only
claude -p --allowedTools "Read,Write,Edit,Bash" "Implement the fixes from audit.md..."
```

## Error Handling
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Context Leakage

High
Category
Data Exfiltration
Content
## Error Handling

When a step fails, capture context for the next attempt. **Redact secrets from the captured diff before passing it on** — `git diff` may include file paths, error messages, or even code that hints at internal structure.

```bash
#!/bin/bash
Confidence
93% confidence
Finding
The error-handling pattern explicitly captures `git diff` into a file and feeds that context back into a later model invocation. Even though the document warns about redaction, diffs can still contain sensitive source code, internal paths, credentials in uncommon formats, or business logic that is unintentionally disclosed to an external model, making this a real context-leakage risk.

External Model or Provider Selection

High
Category
Excessive Agency
Content
rm .error-context.md.bak
  
  # Next attempt includes redacted context
  claude -p "Previous implementation failed (see .error-context.md). Try a different approach..."
fi
```
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The manifest uses broad trigger phrases such as 'autonomous loop', 'parallel agents', and 'continuous integration loop', which can match common user requests and cause this high-risk automation skill to be invoked in contexts beyond the user's intended scope. Because the skill covers unattended PR creation, retries, and merge-oriented workflows, overbroad activation increases the chance of unsafe repository automation being surfaced or followed without sufficient scrutiny.

Static analysis

No suspicious patterns detected.