Morgana Anti Infinite Loop V2 En

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:27 AM UTC
• Version: 2.0.1

Overview

This is a real anti-loop guard, but it promotes observed agent text into system messages and stores loop samples locally by default.

Review before installing in tool-enabled agents. Treat heal output as advisory data, not a trusted system prompt, unless you sanitize and preserve role separation. Avoid passing secrets in action strings, configure or isolate the Loop DNA storage path, periodically delete retained loop history, and install from a pinned, reviewed package in a virtual environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: anti_loop/core.py:249

Finding

Untrusted Agent Content Is Injected into Privileged System Messages

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: anti_loop/core.py:423

Finding

Agent Actions Are Persisted in Plaintext with Inadequate File Protection

Content

View full analysis

Dict[str, Dict]: if self.storage_path.exists(): try: with open(self.storage_path) as f: return json.load(f) except Exception: return {} return {} def _save(self): with open(self.storage_path, 'w') as f: json.dump(self.known_loops, f, indent=2) def fingerprint(self, actions: List[str]) -> str: """Compute SHA-256 of a loop signature.""" canonical = json.dumps(sorted(actions), sort_keys=True) return hashlib.sha256(canonical.encode()).hexdigest() def record(self, actions: List[str], resolution: str = "healed"): """Store a new loop fingerprint.""" fp = self.fingerprint(actions) self.known_loops[fp] = { "actions_sample": actions[:3], "actions_count": len(actions), "first_seen": datetime.now().isoformat(), "resolution": resolution, "occurrences": 1, } self._save() ``` The write is triggered during intervention: ```python if should_intervene: directive = self.healer.inject(action, self.last_intent) # Record DNA if loop_type or is_known: self.dna.record([action], resolution=directive["action"]) ``` ### Technical Analysis Although the feature is described as SHA-256 “Loop DNA,” it stores the first three actions verbatim under `actions_sample`. Agent actions can contain prompts, tool arguments, file paths, customer informati ...[truncated 1572 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:89

Finding

Installation Instructions Resolve Unpinned Remote Packages and Dependencies

Content

View full analysis

=61.0", "wheel"] build-backend = "setuptools.build_meta" ``` ```toml [project.optional-dependencies] embeddings = ["numpy>=1.20"] kan = ["torch>=2.0"] multi-agent = [] all = ["numpy>=1.20", "torch>=2.0"] dev = ["pytest>=7.0", "pytest-cov", "black", "ruff"] ``` ### Technical Analysis The commands install the package named `anti-loop` from the user's configured Python package index rather than necessarily installing the artifact that was audited. No exact version or artifact hash is supplied. Build dependencies and optional runtime dependencies use lower bounds without upper bounds or hashes. Consequently, the effective code installed in the future may differ substantially from the reviewed project. The `[all]` extra also introduces large third-party dependency trees even when those capabilities are not needed. Python packages and build backends can execute code during build or installation. A compromised release, compromised maintainer account, malicious package-index mirror, or future dependency compromise could therefore execute code under the installing user's privileges. ### Attack Path 1. A user follows `pip install anti-loop` or one of the extra-install commands. 2. ...[truncated 1053 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (30)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · anti_loop/core.py (reported line 633)May include surrounding context.

python

}
    
    def reset(self):
        """Reset state between sessions."""
        self.iteration = 0
        self.entropy = PredictiveEntropy(threshold=0.3)
        self.novelty = NoveltyDetector()

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill documents code that writes persistent data to ~/.anti_loop/loops.json but does not declare any tool scope, permissions, or storage behavior up front. In agent ecosystems, undeclared file-write capability weakens least-privilege controls and can lead to unexpected persistence of user or workflow data on the host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description states 'English release,' and the manifest also sets language: "en", but the document does not indicate that users can opt into other languages or that the English-only constraint is necessary for a region-specific or compliance reason. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The Loop DNA feature stores cross-session loop fingerprints in a local file and the documentation also mentions optional community upload, but the skill description does not present this as a clear privacy and persistence warning. Users may enable or integrate the skill without realizing it creates durable local state and may transmit derived behavioral data externally.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring states 'Si même DNA revu → kill instant,' which promises immediate termination for previously seen loop fingerprints. In practice, is_known is computed at L597, but it is not included in the intervention decision at L599-L606 and only affects later recording at L611-L612, so the documented behavior contradicts the actual code.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The component persistently stores loop fingerprints and action samples under the user's home directory by default, creating cross-session retention of potentially sensitive prompts or model outputs. In an agent context, actions may contain secrets, proprietary data, or user content, so silent local persistence expands the data exposure surface beyond runtime memory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The code writes loop history to disk without any user-facing disclosure in this file, which can surprise users and violate data-minimization expectations. Because the stored structure includes action samples and timestamps, it may retain sensitive operational context unnecessarily and create local forensic artifacts.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstring and class descriptions are written primarily in French, including the target audience and operational philosophy, with no indication that users can choose another language or locale. This is a natural-language policy concern because the skill appears to impose a specific language presentation rather than offering user choice or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The top-level docstring describes the skill behavior entirely in French, which can impose a specific language/locale on users without offering a choice or documenting that the skill is region-specific. This matches the policy category for language or locale constraints lacking user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring is written in French ('Avant même d'exécuter un plan...') while the rest of the file is otherwise generic example code. This imposes a specific language without user opt-in or a documented regional/compliance reason, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · examples/02_pre_flight_regex.py (reported line 12)May include surrounding context.

python

def looks_like_a_loop(plan: str) -> bool:
    """Detect: does this plan look like it could loop forever?"""
    guard = AntiLoop()
    issues = guard.pre_flight(plan)
    return len(issues) > 0

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · examples/02_pre_flight_regex.py.auto.md (reported line 26)May include surrounding context.

md

def looks_like_a_loop(plan: str) -> bool:
    """Detect: does this plan look like it could loop forever?"""
    guard = AntiLoop()
    issues = guard.pre_flight(plan)
    return len(issues) > 0

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 721)May include surrounding context.

md

copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring uses French for the module description and usage notes, which can impose a language preference on users or maintainers without opt-in. The policy allows language constraints only when user choice is offered or the locale limitation is clearly justified, neither of which appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The docstring and notes are partially written in French while also naming multiple English-language integrations, which imposes a language expectation without any opt-in or stated locale scope. Under the policy for natural-language issues, forcing or assuming a specific language without user choice can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

These adapter methods ingest and normalize content from external API responses across multiple providers, but the code provides no user-facing disclosure in this file about processing third-party response data. For a safety-oriented skill, handling external/model data should be documented, especially since the skill's stated purpose is loop monitoring across harnesses.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · anti_loop/core.py (reported line 518)May include surrounding context.

python

"""Generic adapter: try common attributes."""
        for attr in ['content', 'text', 'message', 'output', 'result']:
            if hasattr(response, attr):
                return str(getattr(response, attr))
        return str(response)

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest describes a standalone anti-loop guard focused on detecting and healing agent loops. This file's documented capabilities also include wrappers for specific external APIs/harnesses and a main() entrypoint, which broadens behavior from a narrow guard library into integration/driver functionality.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

A loop-prevention skill primarily needs to inspect actions/intents and optionally inject remediation. Providing dedicated adapters for Anthropic, OpenAI, LangChain, AutoGen, and Hermes introduces ecosystem-specific integration capability not inherently required by the anti-loop function itself.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file contains natural-language guidance in French ('Le cas le plus simple', 'Tu wrap ton agent avec le guard') while the rest of the file is otherwise English-oriented. The skill does not indicate that it is intentionally locale-specific or give users an opt-in choice for language, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language content in the docstring is written in French, with no indication that the skill supports user language choice or that French is required for a region-specific purpose. This can violate language/locale policy expectations when a skill implicitly enforces a language without opt-in.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: setuptools has 10 known advisory(ies) (GHSA-27x4-j476-jp5f; GHSA-5rjg-fvgr-3xxf; GHSA-cx63-2mw6-8hw5 +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_zero_dep.py:20