looplia-e2e
Warn
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell scripts (
e2e.sh,e2e-setup.sh,e2e-auto-discovery.sh) that perform build operations (bun run build), dependency management (bun x tsup), and direct execution of local CLI binaries. - [CREDENTIALS_UNSAFE]: The skill interacts with
.envfiles containing sensitive API keys (ZENMUX_API_KEY). Specifically, thee2e-setup.shscript sources the.envfile, andSKILL.mdprovides a troubleshooting command (cat .env | grep ZENMUX_API_KEY) that prints sensitive credentials to the console, exposing them to the agent context. - [PROMPT_INJECTION]: The skill contains explicit instructions and code to bypass platform-level safety mechanisms. It uses
env -u CLAUDECODEandunset CLAUDECODEin thesetup_test_envfunction to circumvent restrictions designed to prevent recursive or nested agent sessions.
Audit Metadata