Möbius Loop

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:23 AM UTC
• Version: 1.0.0

Overview

This is a coherent Loop task-management integration, but it needs Review because it handles a full account token and includes a risky plaintext-token fallback plus broad activation wording.

Install only if you intend your agent to access and update your Loop recurring tasks. Store the Loop Server token through an environment variable or OS secret store, avoid the documented Cursor plaintext fallback, and rotate the token if it may have been exposed. Be explicit when you want the agent to use Loop because the trigger wording is broad.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:119

Finding

Plaintext Storage of Full Account Bearer Token in Cursor Configuration

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 119–120
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Vulnerable Code Snippet

text

`${env:LOOP_SERVER_TOKEN}` resolves from Cursor's environment. If your Cursor version does not interpolate env references in headers, keep the entry in the global, uncommitted `~/.cursor/mcp.json` and paste the token there manually — never into a project-committed file.

Technical Analysis

The documented fallback instructs users to place the Loop Server token directly into ~/.cursor/mcp.json when environment-variable interpolation is unavailable. Although keeping this file outside the project reduces the likelihood of committing the token to source control, it still stores a long-lived bearer credential as plaintext on disk.

The same documentation identifies this token as a full account credential that can claim a Loop web session. Consequently, possession of the token is sufficient for account access; no additional authentication factor is described. A global configuration file does not inherently provide encryption, secret isolation, or protection from other processes running under the user's account.

Sending the bearer token over TLS to the declared Loop MCP endpoint is necessary for the Skill's stated remote task-management functionality. The excessive behavior is specifically the plaintext-storage fallback, not the authenticated network request itself.

Attack Path

1. A user runs a Cursor version that does not interpolate environment references in MCP headers.
2. Following the README, the user inserts the literal Loop Server token into ~/.cursor/mcp.json.
3. Local malware, a compromised process operating as the user, an overly broad backup or synchronization service, another account with filesystem access, or a diagnostic collection process reads the configuration file.
4. The attacker extracts the bearer token.

...[truncated 675 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the recommendation to paste a literal token into ~/.cursor/mcp.json.
2. Require a Cursor version that securely supports environment-variable interpolation in MCP headers.
3. Where interpolation is unavailable, use an OS credential manager, an approved secret-injection mechanism, or a narrowly scoped launcher that obtains the token from protected secret storage without persisting it in the MCP configuration.
4. Treat clients that cannot securely inject the bearer token as unsupported rather than documenting plaintext storage as a fallback.
5. If a credential file is unavoidable, clearly label this as a last resort, enforce owner-only filesystem permissions, exclude it from backup and synchronization systems, and provide explicit rotation instructions.
6. Encourage immediate token rotation after suspected disclosure and minimize the credential's lifetime and privileges where supported by the service.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (5)

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 97% confidence

Finding

The Cursor fallback explicitly instructs users to paste the bearer token manually into ~/.cursor/mcp.json if environment interpolation is unsupported. Even though it warns against committing the file, this still places a full account credential in plaintext on disk in a tool-readable config, where it may be exposed by local compromise, backups, screenshots, sync tooling, or over-broad file access from agents or extensions.

Content

Scanner excerpt · README.md (reported line 119)May include surrounding context.

}

text

`${env:LOOP_SERVER_TOKEN}` resolves from Cursor's environment. If your Cursor version does not interpolate env references in headers, keep the entry in the global, uncommitted `~/.cursor/mcp.json` and paste the token there manually — never into a project-committed file.

- Pre-tokened: set the env var, restart Cursor so it picks the variable up, verify via the agent (`loop_account`).
- Cold: configure without the `headers` block, run the agent-driven flow, store the token, restore the header.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 16)May include surrounding context.

md

Loop offers a general daily reminder in its own iOS and connected Telegram settings, but
this integration has no reminder-setting tool and smart per-task reminders remain deferred.
Never create a reminder, cron job, or scheduler entry for a Loop task in the host; that
would fork Loop's cadence state.

## Publishing to ClawHub (U9 — gated, not yet done)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README gives conflicting guidance: it says the agent 'writes the token into the environment reference' during cold onboarding, but later says the agent must never materialize, read, print, or copy the token. In practice, this ambiguity can lead implementers or agents to handle the token directly, increasing the chance of credential exposure through chat, logs, files, or command history.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation text is overly broad, including generic terms like routines, habits, chores, todos, and phrases such as 'what's on today?'. That can cause the skill to trigger in conversations that are not actually about this specific external service, increasing the chance of unintended access to personal task data or accidental remote state changes through MCP tools.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · README.md (reported line 130)May include surrounding context.

md

## Token custody

- The Server token is the full account credential — it can also claim a Loop web session. The MCP tool surface is reversible-only, but a leaked token is not limited to that surface.
- Reference the token from the environment or the host's OS-secret store wherever the host supports it (`${LOOP_SERVER_TOKEN}` / `${env:LOOP_SERVER_TOKEN}` above). NEVER put a literal token into a committed config or an example — every snippet in this directory uses the env reference.
- The agent must never materialize the token: never read, print, expand, or copy it into chat, logs, files, URLs, command arguments, a browser, or another tool. Only the configured MCP connection resolves the env reference; it is revealed exactly once, in the user's browser at the `loop_pair` reveal link — the agent never receives it over MCP.
- Rotation: Loop web app → Settings → Server token actions → **Replace Server token**. This invalidates the old bearer immediately — MCP calls answer `invalid_token` until the stored token is updated. Rotate on any suspected compromise.

Static analysis

No suspicious patterns detected.