ClawHub
Back to skill

Security audit

Loop Engineering

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only skill about designing autonomous agent loops, with some automation examples users should apply carefully.

Install only if you want guidance on autonomous loop design. Treat its cron, auto-fix, and sub-agent examples as templates: use dry runs, max-round limits, logs, tests, branch isolation, and human approval before allowing unattended code changes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The suggested trigger phrases for loop-specific skills are generic enough to match ordinary user requests, which can cause unintended auto-activation of a powerful skill during unrelated tasks. In a loop/orchestration platform, accidental routing can expand tool access or enable autonomous actions in contexts where the user did not intend them, increasing the chance of unsafe execution paths.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The cron task example explicitly instructs the system to 'auto-fix issues' but does not warn that this may modify repository contents without direct human review. In the context of scheduled autonomous loops, this is risky because recurring unattended execution can repeatedly change code, introduce regressions, or commit unsafe modifications before a human notices.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.