loom-plan-execution

Fail

Audited by Gen Agent Trust Hub on Jul 1, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions to download .NET packages from the NuGet registry and execute the contained binary files locally. It specifically directs the agent to fetch the Loom Agent Execution Orchestrator runtime and run it using the dotnet exec command. Evidence: Download instructions and URLs found in reference/packages.released.md and reference/packages.beta.md targeting nuget.org.
  • [COMMAND_EXECUTION]: The skill relies extensively on shell commands to manage its runtime environment. This includes using the dotnet CLI for building components from source, running the orchestration engine, and resuming workflow states. Evidence: Pervasive use of commands like dotnet ao.dll run, dotnet ao.dll resume, and dotnet build in SKILL.md and reference documentation.
  • [EXTERNAL_DOWNLOADS]: The skill fetches its core execution engine from an external public registry. Evidence: URLs for .nupkg files on nuget.org are provided for runtime acquisition in the package reference files.
  • [PROMPT_INJECTION]: The skill processes complex user-defined plans and external audit data to drive its orchestration logic, creating a surface for indirect prompt injection. 1. Ingestion points: Processes plan_text, plan_file, and audit_artifacts. 2. Boundary markers: Absent; there are no instructions to the agent to isolate or ignore potentially malicious instructions within these inputs. 3. Capability inventory: The skill possesses high-privilege capabilities including arbitrary command execution (dotnet) and file system access. 4. Sanitization: Absent; no validation or filtering of external input content is specified.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jul 1, 2026, 09:09 AM
Security Audit — agent-trust-hub — loom-plan-execution