Security audit

loop-constructor-codex

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly transparent and design-only, but its generated Codex runbooks can drive autonomous code changes and the artifacts admit a known contract-protection gap that can let unsafe designs pass review.

Install only if you want a design aid for Codex CLI loop runbooks and are prepared to review the generated .loop files before running them. In particular, manually require contract.md, AGENTS*/AGENTS.override.md, .codex/, .rules, and .loop/prompts to be outside the generator's write surface or hash-verified before evaluator launches; do not rely on a clean linter/fresh-reader pass alone as proof of that boundary.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (25)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
md
**machine-checkable loop-design JSON** (which `scripts/lint_loop_design.mjs` PASSes) plus

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
md
**machine-checkable loop-design JSON** (which `scripts/lint_loop_design.mjs` PASSes) plus

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.
md
**machine-checkable loop-design JSON** (which `scripts/lint_loop_design.mjs` PASSes) plus

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.
md
**machine-checkable loop-design JSON** (which `scripts/lint_loop_design.mjs` PASSes) plus

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
roles, agree the contract (the LOOPS.md operating model, `references/loops-model.md`).

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
md
roles, agree the contract (the LOOPS.md operating model, `references/loops-model.md`).

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
md
roles, agree the contract (the LOOPS.md operating model, `references/loops-model.md`).

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
md
roles, agree the contract (the LOOPS.md operating model, `references/loops-model.md`).

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.
md
node scripts/render_loop_doc.mjs <design.json> # writes .loop/<slug>.loop.{md,json}

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
node scripts/render_loop_doc.mjs <design.json> # writes .loop/<slug>.loop.{md,json}

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.
md
node scripts/render_loop_doc.mjs <design.json> # writes .loop/<slug>.loop.{md,json}

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.
md
| `assets/golden-loop-design-medium.json` | A passing **staged** fixture — copy as the starting point for a decomposed design. |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.
md
`CHANGELOG.md`, and the renderer adds the Codex preamble. A change to the schema the

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.
md
`CHANGELOG.md`, and the renderer adds the Codex preamble. A change to the schema the

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · references/codex-runtime.md (reported line 22)May include surrounding context.
md
**Codex facts — observed on codex-cli 0.144.4, 2026-09-25** (local `codex exec --help`, `codex features list`, strings in the native binary; local observation, not vendor docs — re-stamp at each codex-cli release, `references/loops-model.md` §VIII): non-interactive run `codex exec "<prompt>"` (each call = a fresh process/context; `-C <dir>` sets its working root); session continuation `codex resume`; project instructions in **AGENTS.md** (read at every directory level walked, plus `AGENTS.override.md` and any `project_doc_fallback_filenames`); config `~/.codex/config.toml` (location `$CODEX_HOME`);

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · references/codex-runtime.md (reported line 25)May include surrounding context.
md
run `codex exec "<prompt>"` (each call = a fresh process/context; `-C <dir>` sets its working root); session continuation `codex resume`; project instructions in **AGENTS.md** (read at every directory level walked, plus `AGENTS.override.md` and any `project_doc_fallback_filenames`); config `~/.codex/config.toml` (location `$CODEX_HOME`); a project `.codex/` directory (`hooks.json`, skills); execpolicy `.rules` files; sandbox modes `read-only` / `workspace-write` / `danger-full-access` + an approval policy; MCP servers in `config.toml`; skills installed at `~/.codex/skills/<name>/`. Features:

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · references/codex-runtime.md (reported line 67)May include surrounding context.
md
# contract must still equal the contract-time tag (the generator's diff never touches them) git worktree add .loop/eval-checkout <stage-tag> git diff --exit-code <contract-tag> <stage-tag> -- ':(glob)**/AGENTS*.md' .codex '*.rules' .loop/prompts contract.md codex exec -C .loop/eval-checkout --sandbox read-only "$(cat .loop/eval-checkout/.loop/prompts/evaluator.md)" # (b) or verify the surface set recorded at contract time, then launch # (the checksum file itself kept outside the generator's write surface) shasum -a 256 -c <owner-dir>/eval-surfaces.sha256 # every AGENTS*.md, .codex/**, *.rules, .loop/prompts/*, contract.md

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file presents the current documentation as '简体中文' with only a link out to English, indicating a default language constraint in the skill description. Under the policy, forcing a specific language without explicit user opt-in is a natural-language locale violation unless clearly justified as region-specific, which is not stated here.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README explicitly acknowledges a trust-boundary failure: newly generated loop designs may still allow the generator to modify protected contract.md content while all checks continue to pass. Even though the skill claims it only designs and does not execute, this is dangerous because it emits runbooks intended for later execution by Codex, so a flawed design can institutionalize unsafe authority boundaries and cause downstream autonomous runs to trust tampered contracts or reviewer inputs.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/codex-runtime.md (reported line 28)May include surrounding context.
md
`project_doc_fallback_filenames`); config `~/.codex/config.toml` (location `$CODEX_HOME`); a project `.codex/` directory (`hooks.json`, skills); execpolicy `.rules` files; sandbox modes `read-only` / `workspace-write` / `danger-full-access` + an approval policy; MCP servers in `config.toml`; skills installed at `~/.codex/skills/<name>/`. Features: `hooks` stable (on), `multi_agent` stable (on), `memories` experimental (on). Isolation flags exist — `--ephemeral`, `--disable <feature>` (e.g. `memories`), `--ignore-rules`, `--ignore-user-config` — but their effect on what a fresh process reads was **not run**,

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: At L125 the document includes a Chinese-language reference fragment ("附录一 A45 参数行") inline in otherwise English instructions, which imposes a locale/language assumption without offering a user choice. This matches the policy category for language/locale violations because the file does not explain that the skill is region-specific or provide an opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file contains a mixed-language policy statement using Chinese text ("第九章" and "附录一") without any indication that the skill is region-specific or that users can choose their preferred language. Under the language/locale policy rule, forcing a specific language in natural-language content without opt-in can be a policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file includes the command git worktree remove --force as part of the operator loop, which is a destructive operation that can discard uncommitted changes in the stage worktree. The surrounding text describes when to run it, but does not explicitly warn the operator about potential data loss or the need to verify that important changes are preserved first.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file documents that scripts/render_loop_doc.mjs writes generated artifacts to a fixed project directory, defaulting to .loop/ and producing both Markdown and JSON outputs. The description explains behavior but does not explicitly warn users that running the command will create or overwrite files in the workspace.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: At L269 the reference token "[SELF-caoliao军备赛]" introduces Chinese characters in a context that otherwise assumes English, without any explanation or language choice. This is a natural-language locale-policy concern because users are not told that mixed-language references are expected or necessary.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.