Is Forward-Future/loopy safe?
https://github.com/Forward-Future/loopy
Forward-Future/loopy is a well-structured AI agent skill for discovering, crafting, auditing, running, and publishing reusable agent workflows ('loops'). The SKILL.md contains explicit and thoughtful security language that instructs the agent to treat analyzed content as untrusted and to require explicit user approval before any external submission. No malicious code, git hooks, hidden instructions, npm install scripts, or canary exfiltration was detected during the audit. The primary residual risk is a trust dependency on the external catalog domain (signals.forwardfuture.com) whose content is fetched into agent context at runtime, and the broad execution scope of the 'Run' workflow which delegates action authority to user-defined loop prompts.
Category Scores
Findings (5)
LOW External catalog URL fetched into agent context -18 ▶
The skill instructs the agent to fetch live catalog data from signals.forwardfuture.com on every 'Find' invocation. The fetched markdown/JSON is treated as reference data by the agent. If the domain or CDN were hijacked, adversarial loop prompts in the catalog could influence agent behavior.
LOW Run workflow delegates broad filesystem and shell scope to loop prompts -7 ▶
The 'Run' path executes whatever loop the user identifies within the agent's authorized scope. A poorly crafted or malicious loop prompt saved in LOOPS.md could instruct the agent to take unintended actions. The skill does include stop conditions and approval boundaries, but enforcement depends on the loop author's quality.
INFO Dual-skill SKILL.md structure injects two personas via one file 0 ▶
SKILL.md contains two separate YAML frontmatter blocks (loop-library and loopy) stacked in a single file. Platforms that consume the full SKILL.md will inject both skill definitions into the system prompt. This is not malicious but may produce unexpected behavior if a platform only expects one skill per file.
INFO Publish workflow submits to external endpoint — gated by explicit approval 0 ▶
The Publish flow can submit a loop to the Loop Library catalog via the Worker API. This is the only outbound data path. The skill explicitly requires 'explicit approval before any external submission' and shows a preview first.
INFO Canary file accesses predate clone — audit infrastructure origin confirmed 0 ▶
inotify and auditd records show .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and GCP credentials accessed at 17:31:38 (timestamp 1785000698). The git clone completes at timestamp 1785000704 (~6 seconds later). The accessing process is pid=1107 (sudo, ppid=1086), consistent with the audit harness initializing canary monitoring. No skill code was running at this time.