loop-library
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill retrieves a live catalog of loops from 'https://signals.forwardfuture.ai/loop-library/catalog.md' and '.json'. These URLs belong to the upstream vendor infrastructure and are used solely for the documented purpose of recommending published loops.- [INDIRECT_PROMPT_INJECTION]: The 'Discover' and 'Audit' workflows involve processing user-supplied codebases and thread histories. The skill identifies this risk surface and explicitly instructs the agent to treat such content as untrusted evidence and to never execute embedded instructions found within these sources (evidence in SKILL.md, references/discover.md, and references/audit.md).
Audit Metadata