autonomous-loops — security audits

Flagged by auditors

Independent security partners scan this skill's files for malicious content, prompt injection and risky patterns. Verdicts below come from the skills.sh audit program; each partner links to its full report.

• Gen Agent Trust Hub

  fail

  The skill contains a critical security risk by instructing users to execute a remote shell script using 'curl | bash' from an untrusted third-party repository. Additionally, the autonomous agent loop architectures described in the skill are vulnerable to indirect prompt injection as they ingest untrusted data like external specifications and CI logs without adequate sanitization or boundary markers.

  Risk: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTIONMar 22, 2026Full report

• Socket

  warn

  1 alert: gptSecurity

  Mar 22, 2026Full report

• Snyk

  fail

  Risk: CRITICAL · 3 issues

  Risk: CRITICALMar 22, 2026Full report

• Runlayer

  warn

  1/1 file flagged

  Risk: MEDIUMMar 6, 2026Full report

• ZeroLeaks

  pass

  Score: 93/100 · 2 sections analyzed

  Risk: NONEApr 16, 2026Full report