ClawHub
Back to skill

Security audit

Alibabacloud Agentloop Experience

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-built for AgentLoop recall, but it can send task details to an external endpoint under broad trigger rules using locally stored credentials.

Install only if users understand that recall queries may include task, error, incident, service, request, case, or file-path details and will be sent to the configured AgentLoop endpoint with local credentials. Prefer explicit per-query approval, keep AGENTLOOP_CONFIRM_OUTBOUND unset unless operationally required, and avoid using recall for secrets, regulated data, or confidential incident details without redaction.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
79% confidence
Finding
The skill instructs use of a local CLI that reads credentials and endpoint configuration from environment files, but no explicit permission declaration is present. This creates a transparency and policy-enforcement gap: an agent may access local secrets or make outbound authenticated requests without the platform surfacing that capability to users or reviewers.

Vague Triggers

High
Confidence
93% confidence
Finding
The trigger language is extremely broad and encourages activation whenever a request merely suggests prior work may help, including many ordinary troubleshooting or implementation prompts. In this skill's context, activation can send user task text to an external recall endpoint, so over-triggering increases the chance of unnecessary data exfiltration, including sensitive internal identifiers, incident details, or code-related context.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The instruction to use recall proactively 'as one of your very first actions' and to strongly prefer recalling up front lacks limiting conditions tied to sensitivity, necessity, or minimal disclosure. Even though the skill mentions approval, it also treats many implied phrases as approval, which can normalize sending task details externally before sufficient triage or redaction.

Static analysis

No suspicious patterns detected.