loop-runner
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes arbitrary shell commands provided via the
--verifyand--revisearguments as part of its core autonomous loop functionality. While intended, this allows for the execution of any system command accessible to the agent.\n- [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface where untrusted data could influence future agent behavior through episodic memory poisoning.\n - Ingestion points: Workspace files identified by the
--stateglob are hashed and processed; additionally, the output from the verify/revise shell commands is used to generate lessons.\n - Boundary markers: No specific delimiters or safety instructions are described to prevent the agent from obeying instructions embedded in the workspace files or command outputs when they are later reviewed in the episodic memory.\n
- Capability inventory: The skill can execute shell commands, read and hash workspace files, and write to run-logs and episodic wiki pages.\n
- Sanitization: There is no evidence of sanitization or validation for the content written to the episodic memory wiki page.
Audit Metadata