Agentloopkit— agent skill

Agentloopkit — independently scanned and version-tracked by SaferSkills.

by abhiyoheswaran1·Agent Skill·github.com/abhiyoheswaran1/AgentLoopKit

Is Agentloopkit safe to install?

SaferSkills independently audited Agentloopkit (Agent Skill) and scored it 66/100 (yellow). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 8 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

Score
66/100
●●●●●●●○○○
↑ +0 since first scan (66 → 66)Re-scan~30s
Latest scan
ScannedJun 24, 2026 · 30d ago
Scans run1 over 90 days
Detectors55 checks · 5 categories
Findings8 warnings · 0 high
EngineSaferSkills 2b638c6
View methodology →
SaferSkills installs
This week0
This month0
All time0
CategoryWeightCategory scoreContribution
Securityprompt, exec, net, exfil, eval
35%
4
1.4 pts
Supply chainhash, typosquat, maintainer, lockfile
20%
100
20.0 pts
Maintenancestaleness, pinning, CI
15%
100
15.0 pts
TransparencySKILL.md, perms, README
15%
100
15.0 pts
Communityinstalls, verify, response
15%
100
15.0 pts

Findings & checks · 8 flagged

Securityscore 4 · 8 findings
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · .agentloop/research/interview-cycle-008.md
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerpt.agentloop/research/interview-cycle-008.md· markdown
58- Elias: This helps the repo feel maintained from day one.
59- Nora: Ask for artifacts, not essays.
60- Samir: Do not ask users to paste secrets or `.env` contents.
61- Lina: Agents can fill these fields after `summarize`.
62- Tom: This is practical. It asks for evidence.
Occurrences
1 occurrence · at L60
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484arubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · .agentloop/research/interview-cycle-009.md
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerpt.agentloop/research/interview-cycle-009.md· markdown
58- Elias: A manual workflow retry helps maintainers recover without another release.
59- Nora: The docs should say the exact command and the exact failure.
60- Samir: Do not add tokens. Do not ask for OTPs in chat.
61- Lina: Agents should report release state from npm, not from intent.
62- Tom: A failed publish is not a launch success.
Occurrences
1 occurrence · at L60
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484arubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · .agentloop/research/interview-cycle-012.md
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerpt.agentloop/research/interview-cycle-012.md· markdown
56- Elias: Good first issue scaffolding helps contributors trust the repo.
57- Nora: The first-contribution path should be short and direct.
58- Samir: Do not ask contributors to paste secrets or environment values.
59- Lina: Good starter issues should still ask for AgentLoopKit verification evidence.
60- Tom: Labels matter only if they make review easier.
Occurrences
1 occurrence · at L58
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484arubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · .agentloop/research/interview-cycle-015.md
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerpt.agentloop/research/interview-cycle-015.md· markdown
67- Elias: Update launch docs and the release note now. People read release pages quickly.
68- Nora: Give users one install command that works today.
69- Samir: Do not ask for or store tokens. Trusted publishing is the right path.
70- Lina: `0.2.1` has useful agent-loop improvements, but failed install commands hurt trust.
71- Tom: A failed publish is not a disaster. Hiding it would be.
Occurrences
1 occurrence · at L69
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484arubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · .agentloop/research/interview-cycle-038.md
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerpt.agentloop/research/interview-cycle-038.md· markdown
58- Elias: Update launch checklist, npm docs, and release notes.
59- Nora: Make the next action concise: configure npm trusted publishing or complete local bro
… (14 chars elided on L59)
60- Samir: Do not ask for credentials or OTPs.
61- Lina: Agents resuming release work need the exact state.
62- Tom: npm latest remains the only proof for `npx`.
Occurrences
1 occurrence · at L60
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484arubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · .agentloop/research/interview-cycle-076.md
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerpt.agentloop/research/interview-cycle-076.md· markdown
65- Elias: Contributors should see issue examples before release internals.
66- Nora: Put copyable examples in one page and link it from `CONTRIBUTING.md`.
67- Samir: Keep verification expectations explicit. Do not ask contributors to paste secrets o
… (15 chars elided on L67)
68- Lina: Ask for task, verification, and handoff evidence where the contributor uses AgentLoo
… (5 chars elided on L68)
69- Tom: Remove vague community language. Name files, commands, and review expectations.
Occurrences
1 occurrence · at L67
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484arubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · .agentloop/research/interview-cycle-085.md
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerpt.agentloop/research/interview-cycle-085.md· markdown
67- Elias: "Update README and publishing docs so visitors do not assume npm is current."
68- Nora: "The release notes should lead with the reviewer value: task-linked verification and
… (27 chars elided on L68)
69- Samir: "Skip npm publish unless auth is proven. Do not ask for tokens."
70- Lina: "GitHub tarball fallback keeps power users unblocked."
71- Tom: "Say npm latest is `0.1.1`. Do not over-explain."
Occurrences
1 occurrence · at L69
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484arubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · .agentloop/research/interview-cycle-088.md
MEDIUMit fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerpt.agentloop/research/interview-cycle-088.md· markdown
47### Security Reviewer
48 
49- What they liked: The docs do not ask for tokens or hidden install scripts.
50- What confused them: The handoff does not name the current tarball fallback as temporary.
51- What they would need before using it: Clear npm-auth blocker, no publish attempt, and no c
… (20 chars elided on L51)
Occurrences
1 occurrence · at L49
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25612211d7a427c799arubric 365aacaView on GitHub
Supply chainscore 100 · 0 findings
All supply chain checks passedNo findings in this category for the latest scan.pass
Maintenancescore 100 · 0 findings
All maintenance checks passedNo findings in this category for the latest scan.pass
Transparencyscore 100 · 0 findings
All transparency checks passedNo findings in this category for the latest scan.pass
Communityscore 100 · 0 findings
All community checks passedNo findings in this category for the latest scan.pass
Vendor response · right of reply
Are you the maintainer? Submit a response →

Audit the pieces. Scan the whole. Decide.

~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.