Security audit

Zouroboros Autoloop

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its stated purpose, but it gives an agent broad ability to run shell commands, modify repositories, and start background jobs without strong containment or approval controls.

Install only if you are comfortable allowing this skill to run local shell commands, edit and commit code, reset changes, send target-file contents to your chosen executor, and start background jobs. Use it in a disposable clone or container, review every program.md setup/run/metric command and executor string, avoid repositories containing secrets or production data, and be especially cautious with the MCP start, dry-run, list, and stop tools until command construction and process ownership checks are tightened.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill is presented as a simple optimization loop, but the documentation also describes materially broader behavior: an MCP server, cross-project result enumeration, and spawning detached background processes. That mismatch can mislead users about the true trust boundary, causing them to install or invoke a tool that persists, scans directories, and manages jobs beyond the narrow optimization task they expected.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The tool accepts a user-controlled executor string and forwards it to the autoloop script, enabling arbitrary command execution under the MCP server's privileges. In this context, the skill is advertised as an optimization loop for numeric metrics, not a general-purpose shell runner, so this host-command capability is broader and more dangerous than the stated purpose.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The stop operation reads a PID from a lock file and calls process.kill on it without verifying that the PID belongs to the expected autoloop child process. If an attacker can influence the lock file contents, the tool could terminate unrelated local processes, creating an unjustified host-control primitive.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The tool directly executes `setup`, `runCommand`, and `metric.extract` from `program.md` via shell invocation. Because `program.md` is treated as input rather than trusted code, a malicious or tampered program specification can run arbitrary commands on the host, leading to code execution, file tampering, and data exfiltration.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The `--executor` parameter is interpolated into a shell command and executed, allowing any external command to run with the tool's privileges. This creates an arbitrary command execution path that can be abused by a malicious user, wrapper script, or unsafe invocation, and the executor output is then used to overwrite project files.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The tool accepts an arbitrary user-supplied executor string and forwards it to the underlying autoloop process, which is explicitly designed to run shell-based proposal commands. In an MCP context, this exposes general command-execution capability through a tool that appears to be an optimization helper, enabling misuse well beyond the declared purpose and increasing the risk of arbitrary code execution on the host.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The listing/status logic recursively scans directories under RESULTS_DIR, inspects results files, and reads Git metadata from discovered projects. This can disclose information about unrelated workspaces, repository structure, branch names, and experiment artifacts that are not necessary for operating on a single specified loop.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README explicitly promotes an autonomous loop that edits files, creates git branches, runs experiments, and invokes arbitrary executor and run commands, but it does not prominently warn users that this behavior can modify code and execute commands on the host. In a security-sensitive agent ecosystem, missing safety warnings and trust-boundary guidance increases the chance that users will run the tool against sensitive repositories or with dangerous executors, leading to unintended code changes or command execution.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill advertises autonomous code edits plus git commit/revert behavior without a clear warning that it will modify repository contents and history-related state. In practice, users may run it in a valuable or dirty repository and unintentionally trigger destructive changes, accidental commits, branch proliferation, or execution of project-defined commands supplied through `program.md`.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The tool executes `setup` and `runCommand` taken from `program.md` via `bash -c`, which means anyone supplying or modifying that spec can run arbitrary shell commands on the host. In this skill's context that behavior is core functionality, but the absence of an explicit user-facing warning or trust boundary makes accidental unsafe execution materially more likely.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The `executor` value is interpolated directly into a shell command and run, so a user-supplied executor string can execute arbitrary commands beyond the intended LLM CLI. Since this tool is designed to accept external command strings, the danger comes from weak guardrails and lack of clear warning rather than hidden maliciousness.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: `proposeChange` reads repository file contents and sends them to an external executor without any explicit privacy or exfiltration warning. In an autonomous code-editing loop, this can leak proprietary code, secrets embedded in files, or sensitive notes to third-party tools or remote APIs configured behind the executor.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The tool launches a detached background subprocess and immediately returns success, with no confirmation step or prominent warning that a persistent local process is being created. In an MCP setting, this can surprise users and increase the risk of unauthorized long-running activity, resource consumption, or follow-on actions outside the immediate session.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The stop command performs destructive actions by deleting the lock file and attempting to terminate a process without an explicit warning or confirmation. In a tool exposed to agents, this raises the chance of accidental disruption of active work and compounds the risk from the weak PID validation logic.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This skill autonomously creates branches, overwrites the target file, commits changes, and may revert with hard resets, but it does not require an explicit confirmation after showing the parsed configuration and planned actions. In a code-modifying loop driven by LLM output and shell commands, lack of a user checkpoint increases the chance of unsafe or unintended destructive actions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code executes shell commands derived from program configuration without displaying a strong safety warning or requiring explicit acknowledgment that the configuration is trusted. In this context, the commands are high-risk because they can perform arbitrary system actions under the user's account.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The start operation launches a detached child process and, in dry-run mode, executes the assembled command immediately, but provides no confirmation, warning, or safety interlock to the caller. In an agent-integrated environment, this makes it easy for an LLM or untrusted client input to trigger host-side execution without the user clearly understanding that code or long-running processes will be started.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The stop operation reads a PID from a lock file, attempts to terminate that process, and deletes the lock file without verifying ownership or requiring confirmation. If the lock file is stale, manipulated, or points to an unrelated process, this could terminate the wrong process and interfere with other workloads.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/autoloop.js:16

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/mcp-server.js:98

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/autoloop.ts:74

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/mcp-server.ts:121