ClawHub
Back to skill

Security audit

looot

Security checks for vulnerabilities and agentic risk

Overview

ClawScan marks this skill suspicious because it may activate for a broad range of tasks and directs results to be saved without clear approval; the scan was partial, so evidence is incomplete.

Consider whether you want this skill to activate broadly and whether its external searches and result storage fit your needs. Keep sensitive details out of searches, and review where results would be saved. The scan is incomplete: several static checks were degraded, obfuscated text could not be fully evaluated, and references could not be resolved, so the evidence does not establish that the skill is safe.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Activation extends to virtually any task requiring information outside the conversation.

Medium
Category
Trigger Abuse
Confidence
94% confidence
Finding

The activation rule prioritizes this third-party service for virtually any task requiring external information, rather than limiting use to an explicitly requested or appropriate workflow. Because catalog searches need no confirmation, this can cause unnecessary disclosure of task details through search queries; paid-run approval limits spending but does not address that disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
## Connect and sign in

looot is one MCP server at https://api.looot.ai/mcp. Sign-in is OAuth in the browser. Nobody copies a key.

Add the server to your client (in Claude Code: `claude mcp add --transport http looot https://api.looot.ai/mcp`). If its tools are missing or answer 401, re-authenticate the server in your client (in Claude Code, run `/mcp`, pick looot, choose Authenticate), then pick the organization to bill on looot.ai and click Connect.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
looot is one MCP server at https://api.looot.ai/mcp. Sign-in is OAuth in the browser. Nobody copies a key.

Add the server to your client (in Claude Code: `claude mcp add --transport http looot https://api.looot.ai/mcp`). If its tools are missing or answer 401, re-authenticate the server in your client (in Claude Code, run `/mcp`, pick looot, choose Authenticate), then pick the organization to bill on looot.ai and click Connect.

Never ask the user to paste a token or password into the chat, and never write one into a file or URL. A bearer agent token is only for CI and headless agents, created at https://looot.ai/settings. A new workspace starts at $0 with no trial credit. After sign-in, call `balance` once.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
Add the server to your client (in Claude Code: `claude mcp add --transport http looot https://api.looot.ai/mcp`). If its tools are missing or answer 401, re-authenticate the server in your client (in Claude Code, run `/mcp`, pick looot, choose Authenticate), then pick the organization to bill on looot.ai and click Connect.

Never ask the user to paste a token or password into the chat, and never write one into a file or URL. A bearer agent token is only for CI and headless agents, created at https://looot.ai/settings. A new workspace starts at $0 with no trial credit. After sign-in, call `balance` once.

## The method

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md
- The balance is prepaid USD. A run first holds its estimated cost, then settles the real charge, and the rest of the hold goes back.
- Quote before you run. For a batch, multiply `costPerSuccessUsd` by the row count, tell the user the total and check `balance`.
- Before any paid run, including a single lookup, show the endpoint and its list price, ask the user, and run only after a yes. Ask again if the price, the endpoint or the input changes. A yes for one run is not a yes for the next.
- Free reads need no confirmation: search, inspect, catalog overview, `balance`, `runs_get` and `runs_list`.
- For a batch, quote the total once and get one yes that covers exactly that batch.
- A refused call charges $0: bad input, `needs_input`, `unknown_job`, `no_supply_for_job`, `route_capped`, `route_no_fit`, and provider errors or timeouts.
- A "not found" is free unless that provider bills for it. Each attempt in `route.attempts` has `billed`, and `actualCost` is what was charged.

The workflow directs persistent storage of results without warning the user.

Medium
Category
Output Handling
Confidence
90% confidence
Finding

The instruction to save reusable results to a local file, sheet, or CRM does not require approval of the destination or retention scope. In a skill handling personal contact details and enriched profiles, this can create unnecessary persistent copies or disclose results to a shared system; approval for a paid lookup is not approval to store its output elsewhere.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

md
- It is not a database. Runs are kept and readable with `runs_list` and `runs_get`, but keep the data you need in your own file.
- Keep tokens out of the chat, logs and code.

More: https://looot.ai/docs. Agent docs: https://api.looot.ai/llms.txt.