Loopwind

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:45 PM UTC
• Version: 0.25.11

Overview

The skill appears to be a real image/video rendering helper, but its install flow asks users to run mutable remote code and install mutable agent instructions without integrity checks.

Review before installing. Prefer a versioned release or package-manager install with published checksums/signatures instead of `curl | bash`, and avoid installing the remote skill URL until its content and installer package are pinned or locally reviewed. Treat remote templates, images, and fonts as network fetches from third parties.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:19

Finding

Unpinned Remote Installation Script Executed Directly by a Shell

Content

View full analysis

Remediation

View remediation

loopwind-install.sh' | sha256sum --check - less loopwind-install.sh bash loopwind-install.sh ``` The checksum must come from a trusted, immutable release record. A checksum downloaded from the same mutable endpoint without independent authentication does not adequately mitigate server compromise. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:39

Finding

Mutable Remote AI Skill Installed Without Version or Integrity Verification

Content

View full analysis

Remediation

View remediation

add ./verified-skill.md ``` 7. Verify `verified-skill.md` before installation: ```bash curl -fL -o verified-skill.md \ https://loopwind.dev/releases/v0.25.11/skill.md echo ' verified-skill.md' | sha256sum --check - less verified-skill.md npx --yes skills@ add ./verified-skill.md ``` 8. Run installation and subsequent agent use with least privilege. Restrict shell access, filesystem scope, credential access, and outbound networking where supported. 9. Require explicit user confirmation before the installed Skill can execute commands, install dependencies, access files outside the project, or transmit data. 10. Maintain a reviewable changelog for Skill updates and do not update installed Skill instructions automatically. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill explicitly fetches and executes an external shell script from https://loopwind.dev/install.sh. In an agent-oriented skill, this is especially dangerous because users may follow the instruction verbatim, leading to immediate arbitrary code execution if the hosted script is altered or compromised.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

Installation

bash

curl -fsSL https://loopwind.dev/install.sh | bash

This installs loopwind to ~/.loopwind/ and adds the loopwind command to your PATH. Requires Node.js 18+.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | bash construct chains remote content directly into a shell, eliminating any review boundary between download and execution. This pattern is a classic high-risk command-execution anti-pattern and is more dangerous in a skill because it normalizes unsafe agent-assisted installation behavior.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

Installation

bash

curl -fsSL https://loopwind.dev/install.sh | bash

This installs loopwind to ~/.loopwind/ and adds the loopwind command to your PATH. Requires Node.js 18+.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation recommends curl -fsSL https://loopwind.dev/install.sh | bash, which executes remote code immediately without inspection, pinning, or integrity verification. If the remote server, transport, or script distribution path is compromised, users could run arbitrary attacker-controlled shell commands on their machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 80% confidence

Finding

The skill instructs users to run npx skills add https://loopwind.dev/skill.md without pinning a package version or integrity source for the skills runner. Because npx may fetch and execute the latest published package, a compromised or typosquatted package could execute unexpected code during installation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description frames the skill as image/video generation via the loopwind CLI, but the skill documentation clearly includes broader package/template acquisition behavior such as loopwind add from direct URLs and loading images/fonts from external URLs. Those are materially broader operations than pure rendering, because they involve retrieving remote content in addition to generation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file describes automatic rendering behavior, and elsewhere documents that rendered output is written to the current directory by default. There is no nearby user-facing warning that using the skill may create local files or that users should review output paths before running commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation encourages loading images from arbitrary URLs during rendering but does not warn that doing so causes outbound requests to third-party hosts. That can leak IP address, timing, user-agent or other request metadata, and may expose agents or CI runners to SSRF-style fetches if untrusted input controls URLs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documents loading fonts from external URLs without warning that rendering will contact third-party servers and download executable parsing inputs into the rendering pipeline. This creates privacy leakage and expands the attack surface for SSRF or malicious-resource abuse when font URLs are attacker-controlled or untrusted.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.