ClawHub
Back to skill

Security audit

Loop Returns

Security checks for vulnerabilities and agentic risk

Overview

The Loop Returns reading workflow fits its purpose, but automatic setup runs unverified remote code and does not explain broader changes the CLI can make to agent skills.

Review and install a verified CLI release yourself before enabling automatic use. Decide whether to allow its bundled-skill synchronization, and connect only the intended Loop Returns account. OOMOL mediates access to return data. The remote installer contents and hosted connector implementation remain unverified.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The supplied command installs software by executing a remote shell script; it does not show any Loop Returns search or read operations. No connection between this installer and the declared service is established, so the observed installation and remote-code execution represent an undeclared capability rather than a demonstrated supporting implementation detail. The downloaded script's further behavior is not visible.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

Piping a live HTTPS response directly into bash executes mutable remote code with the agent process's privileges, without pinning or integrity verification. A compromised distribution endpoint could therefore compromise the local environment; the PowerShell alternative has the same problem, although execution is conditional on the CLI being absent.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

First-time setup instructs the agent to execute downloaded installer scripts without warning about third-party code execution or system changes.

Medium
Category
Output Handling
Confidence
95% confidence
Finding

The fallback directs the agent to install software by executing downloaded shell or PowerShell code without obtaining explicit user approval for local system changes. Although conditional setup is legitimate, a missing dependency should not implicitly authorize arbitrary third-party code execution; the declared tool allowlist may restrict execution, but is not a substitute for safe instructions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md
- **`OOMOL_INSUFFICIENT_CREDIT`** — OOMOL billing stop. Recharge at `https://console.oomol.com/billing/token-recharge` before retrying.

- **HTTP 402 without `OOMOL_INSUFFICIENT_CREDIT`** — the third-party account itself has no active plan or credit. Report the provider error message as is; do not ask the user to recharge OOMOL.

## Resources