Security audit

Project Loop

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly an orchestration aid, but it asks agents to create persistent cron watchdogs automatically and to retry denied obfuscated operations in smaller pieces.

Install only if you are comfortable with persistent background recovery and file-backed task state. Before use, require explicit approval for any cron/watchdog setup, record its schedule and removal command, keep project directories tightly controlled, and remove the instruction to retry obfuscation denials by splitting them up.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T06 · System Persistence

Error

Location: SKILL.md:242
Finding: Automatic Creation of a Persistent Cron Watchdog
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:15
Finding: Untrusted Project Files Are Given Priority Over Current Chat Instructions
Content: View full analysis
`manifest.md` > `validation.md` > `handoff.md` > memory > chat - Only the `owner_agent` in `state.json` executes project tasks - Other agents may improve the skill, but do not run the loop - Do not wait for human confirmation between self-clearable tasks - Keep executing until an approval gate, blocker, or stop condition is reached ``` Related resume behavior appears in `SKILL.md`, lines 69-82: ```markdown ## Session Start and Resume Read in this order: 1. `state.json` 2. `manifest.md` 3. `validation.md` 4. `handoff.md` if present 5. only then memory or chat if still needed Never start by asking “what were we doing?” if project files exist. On resume: - read `status`, `phase`, `current_task_id`, `next_action`, `resume_instructions` - verify state against actual reality before doing anything - continue from recorded state, not guesswork ``` ### Technical Analysis The skill explicitly places project-controlled files above memory and the current chat in its trust hierarchy. It then instructs the agent to continue executing self-clearable tasks without waiting for human confirmation. The specification does not require cryptographic integrity checks, trusted ownership validation, provenance verification, or confirmation when file-backed instructions conflict with the current user's stated intent. Fields such as `next_action`, `resume_instructions`, task manifests, and owner identity can therefore act as persistent instruction channels. If an attacker, compromised process, shared user, or unrelated automation can modify the project directory, the next resume pass may treat attacker-controlled content as authoritative. The instruction to verify state “against reality” doe ...[truncated 1769 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:128
Finding: Denied Operations Are Retried Through Smaller Execution Steps
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · README.md (reported line 109)May include surrounding context.
md
- remove when project reaches `Done` or `Abandoned` - stay silent if there is nothing to resume, retry, or escalate - only report when it acts or finds something worth surfacing - never invent work or bypass approval gates ## Operating Flow 1. read `state.json`

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs automatic creation of a watchdog cron and allows bounded automatic resume behavior, but it does not require prominent user-facing disclosure, opt-in, or per-project consent for background execution. In an agent skill designed to persist and continue long-running work across sessions, this increases the risk of unexpected autonomous actions occurring after the initiating conversation has ended, including resumed execution of stale or no-longer-desired tasks.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.