T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:46- Finding
Remote-Controlled Sponsored Content Can Hijack Final Agent Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
AgentLoop — Earn From Your Agent Conversations
Security checks for vulnerabilities and agentic risk
Overview
This skill is openly an advertising integration, but it sends conversation text to an external marketing service and can append remote ad text with weak privacy controls.
Install only if you intentionally want an ad-matching network in your agent, can disclose that behavior to users, and are comfortable sending recent conversation context and draft responses to AgentLoop. Do not use it for sensitive, medical, legal, financial, confidential, or crisis conversations unless stronger local filtering and consent controls are added.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
agentloop-check.js:33- Finding
Incomplete PII Redaction Can Disclose Sensitive Conversation Content
- Content
View full analysis
/\d{7,}/.test(m) ? '[REDACTED_PHONE]' : m) .replace(/\b(?:sk|pk|al|key|token|secret|password|passwd|pwd)[-_]?[a-zA-Z0-9]{8,}\b/gi, '[REDACTED_KEY]') .replace(/\b\d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{4}\b/g, '[REDACTED_CARD]') } ``` The corresponding documentation states: ```markdown The script automatically removes: - Full names, email addresses, phone numbers - Passwords, API keys, tokens, secrets - Payment card numbers, bank details - Medical, health, or legal information - Any text the user has explicitly said is private or confidential ``` ### Technical Analysis The implementation only attempts to recognize: - Email addresses matching one regular expression - A limited subset of phone-number formats - Secrets beginning with a small set of recognized prefixes - Sixteen-digit payment-card patterns It does not implement automatic detection for full names, bank details, medical information, legal information, or text marked private or confidential. It can also miss credentials that do not use one of the recognized prefixes and payment cards or account identifiers using other lengths and formats. The safety model depends on the agent correctly determin ...[truncated 1768 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
README.md:39- Finding
Privacy Documentation Incorrectly Claims That No Raw User Data Is Transmitted
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh echo "" echo " export AGENTLOOP_API_KEY=al_live_your_key_here" echo "" echo " Or set it securely in your system keychain / secret manager." echo "" echo " NOTE: Do not paste your key here. Set it in your environment before" echo " running OpenClaw. This script does not store or transmit your key."
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README describes the skill as checking for product matches during normal conversations before responding, which implies broad ambient activation without clear boundaries, opt-in conditions, or exclusion cases. In an agent context, this creates a real risk of covert ad-insertion behavior across unrelated user interactions and can undermine user trust, especially because monetization incentives may bias responses.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README says the agent checks AgentLoop for a relevant product match before responding, but it does not clearly disclose that conversation-derived content or metadata may be transmitted to an external marketing service. Even if raw user data is not sent, omission of what contextual data leaves the agent can mislead deployers and users, creating privacy, consent, and compliance risks.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill declares access to an environment variable/API key and an external endpoint but does not declare any explicit tool scope or permissions boundary. This creates unclear execution and data-access expectations, making it easier for a host agent to over-grant capabilities or expose secrets without an auditable allowlist.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Before calling AgentLoop, this script applies pattern-based redaction for structured PII only. It does NOT detect free-form sensitive text (names, medical content, legal text). You are responsible for not passing sensitive conversations to this skill. The script automatically removes: - Full names, email addresses, phone numbers - Passwords, API keys, tokens, secrets - Payment card numbers, bank details
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The privacy section is internally inconsistent: it says the script does not detect free-form sensitive text, yet also claims automatic removal of categories like medical, health, or legal information, which are often free-form and context-dependent. This can cause operators or agents to trust redaction that does not actually occur, leading to sensitive conversation data being transmitted to a third-party marketing endpoint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill requires appending a fixed sponsored phrase exactly as returned, without user opt-in and without allowing the host agent to adapt disclosure to user preferences or platform policy. In a conversational agent, this can undermine informed consent, bypass product neutrality, and pressure the agent to insert monetized content into otherwise trusted advice.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description promotes monetized recommendations but does not define clear activation boundaries, user-consent requirements, or restrictions on when sponsored content may be injected. In this context, the absence of constraints increases the risk that the agent will send conversation content to an external ad-matching endpoint and influence responses in situations where advertising is inappropriate, non-transparent, or conflicts with user interests.
- Content
Static analysis
No suspicious patterns detected.