loops
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands including
npx agenticloops,5dive loop, andghto manage the lifecycle of recurring agents. These commands are essential for the skill's primary function of scheduling and running jobs. - [EXTERNAL_DOWNLOADS]: The skill fetches the
agenticloopsCLI package vianpxand downloads loop definitions from theagenticloops.devdirectory and public GitHub repositories. - [REMOTE_CODE_EXECUTION]: The skill enables the installation and execution of external 'loops' which contain prompts and skill references. To mitigate risk, the instructions include a 'Vet before recommending' section that guides users to evaluate the loop's required permissions (CLI tools, secrets, network egress) and author reputation before scheduling them for unattended execution.
- [SAFE]: The skill implements safe practices for sensitive data by ensuring that secrets are only referenced by environment variable names (e.g.,
X_API_TOKEN) within loop files, ensuring that actual credential values are never stored in the shared definitions. It also uses a 'declare-and-check' model for requirements to provide visibility into what a loop will access before it is run.
Audit Metadata