Alibabacloud Agentloop Experience

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:59 AM UTC
• Version: 0.0.1

Overview

This skill has a coherent recall purpose, but its credentialed outbound lookup can be redirected by project-level configuration in a way that may expose a user's stored API key.

Install only if you trust the repositories where it will run and the configured AgentLoop endpoint. Avoid project-level .agentloop/recall.env files from untrusted repos, do not enable AGENTLOOP_CONFIRM_OUTBOUND broadly, and verify the destination before allowing recall with reusable API keys.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/search_context.js:76

Finding

Project-Level Configuration Can Redirect User Credentials to an Attacker-Controlled Endpoint

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

or AgentLoop experience one of your very first actions, using the local CLI at `scripts/search_context.js`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

or AgentLoop experience one of your very first actions, using the local CLI at `scripts/search_context.js`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

or AgentLoop experience one of your very first actions, using the local CLI at `scripts/search_context.js`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

or AgentLoop experience one of your very first actions, using the local CLI at `scripts/search_context.js`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md

or AgentLoop experience one of your very first actions, using the local CLI at `scripts/search_context.js`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/search-context-cli.md (reported line 58)May include surrounding context.

md

- `AGENTLOOP_RECALL_ENDPOINT`: AgentLoop Recall or SearchContext HTTP endpoint.
- `AGENTLOOP_CONFIRM_OUTBOUND`: optional automation setting. When `true`, permits outbound recall without passing `--confirm-outbound`; set only after user or operator approval.
- `AGENTLOOP_ACCESS_KEY`: Alibaba Cloud access key for AK/SK signed requests.
- `AGENTLOOP_ACCESS_SECRET`: Alibaba Cloud access secret for AK/SK signed requests.
- `AGENTLOOP_BEARER_API_KEY`: ContextStore API Key copied from the Memory/Experience store API Key tab. The CLI sends it as `Authorization: Token ...`.

## HTTP Request

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill clearly expects access to environment-based credentials via recall.env and network egress to an external Recall endpoint, but it declares no explicit tool scope or permissions boundary. That mismatch can cause the host agent to invoke the skill with broader capabilities than intended or without clear user/auditor visibility into secret and outbound-data use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are broad enough to activate on many ordinary requests about checking prior work, including vague or implied references and multilingual phrases. In this skill’s context, unintended activation can cause unnecessary transmission of user task details to an external recall service, increasing privacy and data-exposure risk even when the user did not specifically intend outbound recall.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to use recall proactively as one of its first actions based on implied need, without strong boundaries on when not to send data. Because the workflow treats many phrases as implicit approval, this increases the chance that sensitive incident details, file paths, service names, or error strings are sent to an external endpoint before necessity is established.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/ram-policies.md (reported line 17)May include surrounding context.

md

- AK/SK mode: `context_type` (`experience` only in the current rollout), `limit`, `threshold`, `filter`, and `formatted`
- API Key mode: `top_k`, `threshold`, and `filters` for `/v2/memories/search`

The CLI requires `--confirm-outbound` or `AGENTLOOP_CONFIRM_OUTBOUND=true` before transmitting query data. Without confirmation, it exits before reading credential variables.

After confirmation, the CLI reads `AGENTLOOP_ACCESS_KEY` / `AGENTLOOP_ACCESS_SECRET` or `AGENTLOOP_BEARER_API_KEY` only from `~/.agentloop/recall.env`, the nearest project `.agentloop/recall.env`, or process environment variables. Secrets must not be passed as command-line arguments.