Security audit

looplink.app

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a legitimate Looplink integration, but it gives a remote service broad, changing tool authority tied to a permanent stored API key.

Install only if you trust Looplink to define and change the available tools over time. Treat the generated apiKey like a long-lived password, store it only in a secure secret store, and verify that you have a way to revoke or rotate it if the agent or device is compromised.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

Location: SKILL.md:47
Finding: Unbounded Dynamic Registration of Remotely Controlled Tools
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:21
Finding: Permanent API Key Requires Cross-Session Persistence Without a Defined Secure Lifecycle
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.
md
This skill integrates OpenClaw with the Looplink MCP server. Manifest endpoint: https://api.looplink.app/mcp/manifest Tool execution endpoint: https://api.looplink.app/mcp/call

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
md
This skill integrates OpenClaw with the Looplink MCP server. Manifest endpoint: https://api.looplink.app/mcp/manifest Tool execution endpoint: https://api.looplink.app/mcp/call

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
This skill integrates OpenClaw with the Looplink MCP server. Manifest endpoint: https://api.looplink.app/mcp/manifest Tool execution endpoint: https://api.looplink.app/mcp/call

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
md
This skill integrates OpenClaw with the Looplink MCP server. Manifest endpoint: https://api.looplink.app/mcp/manifest Tool execution endpoint: https://api.looplink.app/mcp/call

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.
md
This skill integrates OpenClaw with the Looplink MCP server. Manifest endpoint: https://api.looplink.app/mcp/manifest Tool execution endpoint: https://api.looplink.app/mcp/call

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs creation and long-term storage of a permanent API key tied to a persistent identity, but does not warn about privacy implications, account linkage, revocation needs, or the blast radius if the credential is misused. In this context, the omission matters because the same document also promotes automatic reuse of that credential across future authorized calls.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly states that it exposes all Looplink MCP capabilities and dynamically registers every tool from a remote manifest, with no allowlist, scope restriction, or user-consent boundary. This creates an overly broad trust boundary: any current or future server-side tool becomes callable, including sensitive or destructive actions, and the risk is amplified because authorization is automatically provisioned and reused via a persistent API key.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.