Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/lint_loop_design.mjs` PASSes) plus a **decision log**, and persist it as
Security audit
loop-constructor
Security checks for vulnerabilities and agentic risk
Overview
This skill coherently designs and writes local loop runbooks, with the main risk being expected workspace file creation rather than hidden or malicious behavior.
Before installing, be aware that using the renderer will create .loop runbook/spec files in the target project and that the README's npx install command is not pinned to an immutable version. Review generated loop commands before running them, because the skill designs workflows but does not itself execute or validate target-project effects beyond its local linter checks.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (19)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/lint_loop_design.mjs` PASSes) plus a **decision log**, and persist it as
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `scripts/lint_loop_design.mjs` PASSes) plus a **decision log**, and persist it as
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/render_loop_doc.mjs <design.json> # writes .loop/<slug>.loop.{md,json}
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/render_loop_doc.mjs <design.json> # writes .loop/<slug>.loop.{md,json}
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/render_loop_doc.mjs <design.json> # writes .loop/<slug>.loop.{md,json}
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `assets/golden-loop-design-medium.json` | A passing **staged** fixture — copy as the starting point for a decomposed design. |
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md **Why it's good** — - **Design backward** from "what check proves this is done?" (loop engineering ≈ verification engineering). - A deterministic linter (`lint_loop_design.mjs`) rejects any design with no runnable check, and the renderer refuses to write a runbook for a rejected design — a written `.loop/` doc is itself proof the design passed. - Grounded in the `loop-principle/` KB: cites node ids, reuses its templates/checklists, never restates theory. - **Stops on both sides** (0.3.0) — the stop condition carries a zero-change gate (the anti-arms-race brake) *and* a minimum-progress floor, so the loop can neither spin forever nor quit early; every routing trigger is a counter fixed before the run, not an in-flight judgment call. - **A defect inside the previous fix stops the loop** (0.5.0) — a P0/P1 landing in the last round's own fix (or the fix area growing >50%, or 2 fix rounds on one defect class) now stops the loop and escalates instead of restarting in place; the owner first asks whether that judgment should be in code at all — re-plane is the owner's call, never an action the loop picks. The "impossible / blocked → stop and report" exit is never sealed, and instruction files a generator could write (CLAUDE.md / AGENTS.md) are kept read-only or hash-verified, or the evaluator's independence is recorded as incomplete. The copyable staged example now restarts a stalled stage on that stage itself. Its contract is sized at the endpoint row (≥8 assertions). The example calls itself "multi-module", and the module floor is 12, so this mismatch is recorded as an open P3. Acceptance: the two-arm comparison came out better than the bare model in 3/3 cases, and the battery hit 5/5 seeds with only P3s left. Independence reaches instance tier only (same model), so the verdict is candidate.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Line L17 lists triggers such as "how should I design a loop for X", "design an agent loop", and especially "set up an autonomous / self-running agent workflow", which are natural-language phrases broad enough to match ordinary user requests. The README does not provide explicit trigger boundaries or negative examples beyond the adjacent 'Not for' section, so activation scope remains somewhat ambiguous.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md **When to use** — "how should I design a loop for X" · "design an agent loop" · "set up an autonomous / self-running agent workflow"; or call `/loop-constructor`. **Not for** — "reword this prompt" / single-shot prompt engineering (not a loop design); "now actually run the loop / build the feature" (it designs, does not execute); "add a node to loop-principle" / editing the KB (KB authoring, out of scope); non-agentic / non-loop or domain questions (album / audio / course → the relevant skill). **Install** — `npx skills add VincentJiang06/skills` (or `cp -R skills/loop-constructor ~/.claude/skills/`). The `loop-principle/` KB is embedded in this skill folder and installs with `loop-constructor`. Full spec: [SKILL.md](SKILL.md)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md **什么时候用** —— 「该怎么给 X 设计一个循环」·「设计一个 agent loop」·「搭一个自主 / 自运行的 agent 工作流」；也可用 `/loop-constructor` 显式调用。 **不适用** —— 「帮我改写这段 prompt」/ 单次 prompt 工程（不是循环设计）；「现在真的把这个循环跑起来 / 把功能做出来」（它只设计、不执行）；「给 loop-principle 加个节点」/ 改知识库（KB 编写，超范围）；非 agent / 非循环或领域问题（乐评 / 音频 / 课程 → 对应 skill）。 **安装** —— `npx skills add VincentJiang06/skills`（或 `cp -R skills/loop-constructor ~/.claude/skills/`）。`loop-principle/` 知识库已内置在本 skill 目录里，会随 `loop-constructor` 一起安装。 完整说明见 [SKILL.md](SKILL.md)。
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md **什么时候用** —— 「该怎么给 X 设计一个循环」·「设计一个 agent loop」·「搭一个自主 / 自运行的 agent 工作流」;也可用 `/loop-constructor` 显式调用。 **不适用** —— 「帮我改写这段 prompt」/ 单次 prompt 工程(不是循环设计);「现在真的把这个循环跑起来 / 把功能做出来」(它只设计、不执行);「给 loop-principle 加个节点」/ 改知识库(KB 编写,超范围);非 agent / 非循环或领域问题(乐评 / 音频 / 课程 → 对应 skill)。 **安装** —— `npx skills add VincentJiang06/skills`(或 `cp -R skills/loop-constructor ~/.claude/skills/`)。`loop-principle/` 知识库已内置在本 skill 目录里,会随 `loop-constructor` 一起安装。 完整说明见 [SKILL.md](SKILL.md)。
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The README instructs users to install the skill via
npx skills add VincentJiang06/skillswithout pinning a specific package version or commit. That creates a supply-chain risk: future upstream changes or a compromised package/account could cause users to fetch and run unexpected code during installation.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The README presents Chinese as the active/default language (
**简体中文**) and all substantive instructions in this file are written in Simplified Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language locale violation, especially since this file itself does not offer a choice beyond linking out to a separate English document.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly instructs the agent to persist artifacts under the target project's
.loop/directory, but the top-level description does not clearly warn users that it will write files into the repository. This can cause unexpected workspace modification, especially in sensitive or read-only review contexts, and may lead users to invoke the skill without informed consent about side effects.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This JSON template includes both Chinese and English titles, but the presence of a fixed Chinese title field alongside the English one may impose a locale-specific presentation depending on how the template is consumed. Because the file provides no indication of user language selection or opt-in behavior, it presents a potential natural-language locale policy concern.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file documents that
scripts/render_loop_doc.mjswrites generated files to.loop/by default and can also write to another output directory. While the behavior is documented, it does not explicitly warn users that running the command will create or overwrite files in the workspace, which is the kind of filesystem-impacting behavior SQP-2 asks markdown files to disclose clearly.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Line L116 contains Chinese text ('附录一 A45 参数行') embedded in an otherwise English document, and the file does not indicate that multilingual output is optional or required for a region-specific purpose. Under the stated policy, forcing or introducing a specific language without user opt-in can be a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.