team-loop

• Outcome: Review
• Latest audit: Jul 9, 2026 · 2:03 PM UTC
• Version: 2.4.1

Overview

This is not malware, but it deliberately lets an agent autonomously edit, test, commit, revert, and persist repository context, so users should review it carefully before installing.

Install only in repositories where autonomous edits, commits, reverts, and test execution are acceptable. Prefer a disposable clone or branch, set tight `budget` and `max_rounds`, verify `.team-loop/`, `logs/`, and `rdf/` are ignored or cleaned, avoid running it on untrusted code or secrets-heavy projects, and invoke it only with a precise goal you are willing to let it pursue without further prompts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Starting an independent watchdog process gives the skill persistent process-management capability beyond ordinary task execution. In a human-out-of-loop autonomous system, this increases the chance of runaway background activity, unexpected resource consumption, and harder-to-stop execution if the process supervision logic misbehaves.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The trigger set includes very broad, everyday terms such as `loop` and `迭代`, which materially increases the chance of accidental invocation of a skill that can autonomously modify files, run tests, perform git operations, and persist data. In this context, accidental activation is especially dangerous because the skill is explicitly designed to proceed with zero further human approval once triggered.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill declares autonomous execution with disk-state persistence, incremental delivery, and audit artifacts, but does not present a prominent upfront warning that it will modify source files, tests, logs, RDF data, and git history. In a zero-human-intervention loop, missing disclosure meaningfully increases the risk of users triggering destructive or surprising repository and filesystem changes without informed consent.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The trigger syntax for `/goal` omits a user-facing warning that invocation will automatically run tests/subprocess-style validation, spawn parallel agents, and perform git operations such as commits and reverts. Because the trigger is simple and the system is designed for autonomous loops, users may activate powerful side effects without realizing the operational and repository impact.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The logging design mandates broad retention of agent interactions, messages, tool usage, failures, and token metadata, and elsewhere the skill stores summaries tied to user goals and execution context. In practice, such comprehensive natural-language logging can capture proprietary code details, secrets present in inputs or outputs, and sensitive operational context, creating durable leakage inside the repository or workspace.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: Persisting execution results and lessons learned into an RDF memory store creates a durable cross-run knowledge base that may accumulate sensitive code structure, business logic, failure modes, and user/project-specific context. Because the skill is autonomous and writes this memory by design, leakage can continue silently over multiple rounds and later be re-read by other agents.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Requiring `TaskResult` to include free-form reasoning, tested modules/functions, branch coverage notes, and problem summaries creates a direct channel for plain-language exfiltration of sensitive implementation details. Since these artifacts are passed between agents and persisted in logs/reports, they amplify the chance that confidential code or user data is copied into secondary storage beyond the original source files.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

it will **modify your repository** without further human approval. Be aware:

- **File modification:** Can create, edit, delete source files and tests autonomously
- **Git operations:** May commit, revert, and branch without confirmation
- **Test execution:** Runs project code and tests in subprocesses — untrusted code paths may execute
- **State persistence:** Stores prompts, code context, file paths, and debug logs in `.team-loop/` on disk
- **Broad triggers:** `loop` and `迭代` are common terms — accidental invocation is possible; always review the goal before confirming

• Confidence: 98% confidence
• Finding: The skill is explicitly designed to make and execute autonomous decisions that modify the repository, perform git operations, and run project code/tests without additional human approval. In a repository containing untrusted code or sensitive assets, this can lead to unintended code execution, destructive changes, persistence of sensitive context on disk, and rapid propagation of mistakes before a human can intervene.

Static analysis

No suspicious patterns detected.