ClawHub
Back to skill

Security audit

super-agent-loop

Security checks for vulnerabilities and agentic risk

Overview

This skill is an autonomous task runner whose purpose is coherent, but it includes raw shell execution and broad local state writes without enough scoping or user approval.

Install only if you intend to run a powerful local automation engine. Treat every loop or graph definition as trusted code, review any run commands before execution, prefer dry-run first, and avoid using it on sensitive workspaces unless you add sandboxing, command allowlists, and explicit approval before real execution.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (7)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
return True, "(delegated / no run command)"
    try:
        # 用 utf-8 + errors=replace 防御 Windows 控制台非 UTF-8 代码页导致的崩溃
        r = subprocess.run(step["run"], shell=True, capture_output=True,
                           encoding="utf-8", errors="replace", timeout=60)
        out = (r.stdout or "") + (r.stderr or "")
        return (r.returncode == 0), out.strip()
Confidence
98% confidence
Finding
The code executes `step["run"]` via `subprocess.run(..., shell=True)`, which allows arbitrary shell command execution from the loop definition. If `loop.json` is untrusted or attacker-influenced, this becomes direct command injection and can lead to arbitrary code execution, data theft, or system modification.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill advertises executable behavior via shell commands and file-writing workflow but does not declare any permissions or capability boundaries. In a public skill that orchestrates autonomous execution, this mismatch can cause users or host systems to grant trust without understanding that the skill may invoke command execution and persist data, increasing the chance of unsafe execution or privilege misuse.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The resolver accepts either an arbitrary directory path or any skill name under ~/.workbuddy/skills, enabling this script to read and modify learned_patterns.json for other skills. In a multi-skill environment, that creates unintended cross-skill state access and tampering, which can corrupt telemetry, overwrite preferences, or influence behavior of unrelated skills without clear authorization boundaries.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The engine's core behavior is to execute arbitrary shell from the task definition, which is a powerful and dangerous capability for an orchestration skill. In this context, the skill is explicitly designed as an autonomous loop, which increases risk because planning and execution are tightly coupled and may run attacker-supplied commands without meaningful restriction.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The program performs real shell execution but does not present an explicit runtime warning or consent gate before launching commands. This can mislead operators into treating the tool as a planner/simulator when it is actually capable of changing the host system.

Unvalidated Output Injection

High
Category
Output Handling
Content
return True, "(delegated / no run command)"
    try:
        # 用 utf-8 + errors=replace 防御 Windows 控制台非 UTF-8 代码页导致的崩溃
        r = subprocess.run(step["run"], shell=True, capture_output=True,
                           encoding="utf-8", errors="replace", timeout=60)
        out = (r.stdout or "") + (r.stderr or "")
        return (r.returncode == 0), out.strip()
Confidence
97% confidence
Finding
The command string is passed directly into a shell interpreter, so attacker-controlled input can inject additional shell metacharacters or chained commands. In an autonomous loop engine, this is especially dangerous because generated or modified task definitions may be executed repeatedly across iterations.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
return True, "(delegated / no run command)"
    try:
        # 用 utf-8 + errors=replace 防御 Windows 控制台非 UTF-8 代码页导致的崩溃
        r = subprocess.run(step["run"], shell=True, capture_output=True,
                           encoding="utf-8", errors="replace", timeout=60)
        out = (r.stdout or "") + (r.stderr or "")
        return (r.returncode == 0), out.strip()
Confidence
98% confidence
Finding
This is a tool-parameter abuse issue because the skill exposes a raw command execution primitive through the `run` field with no policy enforcement. An attacker who can influence loop definitions can repurpose the orchestrator to execute destructive commands, exfiltrate secrets, or establish persistence.

Static analysis

No suspicious patterns detected.