Autoloop Controller

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:15 AM UTC
• Version: 1.1.1

Overview

This skill is a disclosed automated loop for improving a target skill, with expected state persistence and subprocess use, but users should treat cron and unattended modes carefully.

Install only if you intentionally want automated skill improvement. Set an explicit target, state directory, max iteration count, and cost cap; use --dry-run first; and enable cron only if you understand it will run unattended and know how to remove the crontab entry. Also review the separate improvement-orchestrator skill because this controller delegates the actual changes to it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a substantial automation system for continuous skill improvement, including iterative orchestration logic and persistence features. The actual code chunk contains only test setup behavior for Python imports during pytest execution. It does not implement any improvement loop, convergence detection, persistence, or cost management, and its purpose is materially unrelated to the declared functionality. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description is for a substantial orchestration skill that continuously improves another skill in a persistent loop with convergence detection and state persistence. The supplied code chunk does not implement that behavior; it only tests a CostTracker/CostRecord utility for budget accounting and summaries. Cost control is one supporting aspect mentioned in the description, but the primary purpose and major capabilities of the declared skill are absent from this code. Therefore, the code chunk does not accurately represent the declared description.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill documentation clearly instructs use of shell execution (python3 scripts/autoloop.py, cron) and persistent file writes (autoloop_state.json, iteration_log.jsonl), but the frontmatter declares no permissions or allowed-tools. That mismatch can cause the platform or a reviewer to underestimate the skill's execution capabilities, which is risky for a long-running automation loop that repeatedly invokes other components and writes state across sessions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger phrase "continuous improvement" is broad enough to activate this skill for many generic user requests, potentially launching an automated multi-iteration process with shell execution and file persistence when the user intended something simpler. In this context, overbroad triggering is more dangerous because the skill is explicitly designed for unattended, repeated execution and can consume budget over time.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger "keep improving" is vague everyday language and could match benign conversational requests, causing accidental invocation of a persistent automation skill. Because this skill can repeatedly call orchestrator logic, write state to disk, and continue across sessions, accidental activation raises the risk of unintended changes, cost spend, and unattended execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guide explicitly recommends unattended cron-based execution of a local script and emphasizes persistence and reliability, but it does not warn about the risks of repeated autonomous execution, such as runaway loops, unintended repeated modifications, or repeated costly actions. In the context of an autoloop improvement skill, this is more dangerous because the purpose is continuous iteration, which increases the likelihood of unattended harmful behavior if the script or its inputs are misconfigured or later altered.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The documented setup creates a persistent local script under the user's skill directory and registers it with cron, establishing durable execution across sessions. This persistence is risky because it can continue operating outside the user's immediate awareness, and in an autoloop controller context it can repeatedly trigger stateful automation long after the initiating session ends.

Content

Scanner excerpt · references/scheduling-guide.md (reported line 6)May include surrounding context.

md

## Recommended: Shell Script + System Cron

### Setup
1. Create run script:
   ~/.claude/skills/autoloop-controller/scripts/run-eval.sh

2. Add to crontab:

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The top-level docstring defines 'single-run' as 'one iteration then exit'. In main(), the single-run branch explicitly continues to the next iteration when no termination condition is met, so single-run can execute multiple iterations instead of exiting after one.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/autoloop.py (reported line 167)May include surrounding context.

python

"--auto",
        ]
        try:
            proc = subprocess.run(cmd, capture_output=True, text=True, timeout=3600)
        except subprocess.TimeoutExpired:
            state.last_failure_trace = "Orchestrator subprocess timed out after 3600s"
            state.status = "error"

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The argument parser exposes a mode named 'single-run' with help text implying a distinct one-shot mode, consistent with the module docstring. However, the single-run branch uses 'continue' and can keep iterating until convergence or limits are hit, contradicting the documented intent of that mode.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The markdown states that state is written to disk after every iteration and shows a command that invokes the controller against a target skill, but it does not explicitly warn users about persistent file creation/modification or subprocess-driven actions. Because this is a markdown file, user-facing documentation should disclose behaviors that may affect user data or system state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The code saves autoloop state to disk via write_json, and later appends iteration logs and creates directories, but there is no docstring, comment, or prompt warning users that this skill persistently writes execution state to the filesystem. For a looping controller, silent persistence can affect user data and system state, so some disclosure should be visible at the operation site or in accompanying documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The script launches another Python program with subprocess.run, which is a safety-relevant operation because it executes external code and may trigger downstream actions. Although the comment notes subprocess isolation, it does not disclose to users that the tool will execute the orchestrator script automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The helper writes JSONL records to iteration_log.jsonl, creating the parent directory if needed, but the only description is an internal docstring for developers. Users are not clearly warned that execution metadata such as timestamps, decisions, scores, and artifact paths will be persisted.

Content

No source excerpt is available for this finding.