loom-plan-execution
Fail
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to download .NET packages from the NuGet registry and execute the contained binary files locally. It specifically directs the agent to fetch the Loom Agent Execution Orchestrator runtime and run it using the
dotnet execcommand. Evidence: Download instructions and URLs found inreference/packages.released.mdandreference/packages.beta.mdtargetingnuget.org. - [COMMAND_EXECUTION]: The skill relies extensively on shell commands to manage its runtime environment. This includes using the
dotnetCLI for building components from source, running the orchestration engine, and resuming workflow states. Evidence: Pervasive use of commands likedotnet ao.dll run,dotnet ao.dll resume, anddotnet buildinSKILL.mdand reference documentation. - [EXTERNAL_DOWNLOADS]: The skill fetches its core execution engine from an external public registry. Evidence: URLs for
.nupkgfiles onnuget.orgare provided for runtime acquisition in the package reference files. - [PROMPT_INJECTION]: The skill processes complex user-defined plans and external audit data to drive its orchestration logic, creating a surface for indirect prompt injection. 1. Ingestion points: Processes
plan_text,plan_file, andaudit_artifacts. 2. Boundary markers: Absent; there are no instructions to the agent to isolate or ignore potentially malicious instructions within these inputs. 3. Capability inventory: The skill possesses high-privilege capabilities including arbitrary command execution (dotnet) and file system access. 4. Sanitization: Absent; no validation or filtering of external input content is specified.
Recommendations
- AI detected serious security threats
Audit Metadata