ClawHub
Back to skill

Security audit

Möbius Loop

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Loop task-management integration with clear guardrails for credentials, browser access, and destructive actions.

Install this only if you want OpenClaw to use your Loop account for personal recurring tasks. Keep the Loop Server token out of chat and stored only as an environment or secret-store value, and be aware that generic todo or routine requests may cause the agent to consult or update Loop.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The README states that during cold onboarding the token never enters chat and the agent only helps with configuration, but the OpenClaw section says the agent 'writes the token into the environment reference.' That inconsistency can lead implementers to let the agent handle or persist the credential, increasing the chance of secret exposure in chat, logs, config files, or tool arguments. In this skill context, the token is explicitly a full account credential and can claim a web session, so unclear custody guidance is more dangerous than a normal docs typo.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill description is triggered by very broad, everyday phrases such as 'todos', 'what's on today?', 'done with the workout', and generic mentions of routines or chores. This can cause the skill to activate in contexts where the user did not intend to access Möbius/Loop, leading to unnecessary exposure of personal task data or unintended task mutations through MCP tools.

Static analysis

No suspicious patterns detected.