Security audit

Swarm Workflow Protocol

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed multi-agent workflow protocol, but it promotes autonomous task handling with a shared relay token and persistent logs without enough safety boundaries.

Review before installing. Use only in a tightly controlled local environment, replace the shared relay token with per-install secrets, avoid sending sensitive task content through the relay, and add explicit approval gates plus log redaction and retention rules.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:12
Finding: Autonomous External Task Routing Can Override User Control
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:62
Finding: Hardcoded Shared Relay Secret and Plaintext Task Transport
Content: View full analysis
` - **Health:** `GET http://localhost:18790/status` - **Auth header:** `x-auth-token: agent-relay-secret-2026` ``` ```bash # Send a message via relay curl -X POST http://localhost:18790/message \ -H "x-auth-token: agent-relay-secret-2026" \ -H "Content-Type: application/json" \ -d '{"to":"Halloween","type":"task_delegation","content":"Build X","report_to":"October"}' ``` ### Technical Analysis The same static authentication token is embedded in both the Skill instructions and README. Every person, agent, or local process that can read the package can recover the token. Because the token is shared, it cannot establish which agent sent a message, and revoking one compromised client requires changing the credential for every client. The relay uses plaintext HTTP. Although the configured endpoint is on `localhost`, plaintext transport still exposes messages to a malicious or compromised local relay service and provides no server-identity verification. If the intended service is absent, another local process could bind to the documented port and impersonate it. The request permits arbitrary task descriptions in the `content` field. No controls require redaction of credentials, personal information, source code, or other sensitive task context before transmission. ### Attack Path 1. An attacker or malicious local process reads the hardcoded token from `SKILL.md` or `README.md`. 2. The attacker connects to the relay on port `18790`, or starts a spoofed relay on that port when the legitimate service is unavailable. 3. The attacker reuses the token to submit a forged `task_delegation` or other trusted-looking message. 4. Altern ...[truncated 898 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:52
Finding: Mandatory Persistent Communication Logging Lacks Data-Minimization Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description describes a system for coordinating multiple agents and managing their communication and routing behavior. The supplied code does nothing related to agent orchestration or communication. Instead, it performs static validation of a SKILL.md file's format and contents. This is a materially different primary purpose, so the description does not accurately represent the code chunk.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill not only includes a hardcoded auth token but also instructs network interaction without warning users that sensitive credentials and message traffic are involved. This increases the chance of accidental credential disclosure, unreviewed local service access, and unsafe agent behavior around authenticated requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The example instructs users to send authenticated orchestration messages over plain HTTP with a shared bearer-like token and provides no warning about transport security or token handling. This can lead to token interception on non-local or misconfigured environments and normalizes an insecure pattern for agent-to-agent command traffic.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 36)May include surrounding context.
bash
# Send a message via relay curl -X POST http://localhost:18790/message \ -H "x-auth-token: agent-relay-secret-2026" \ -H "Content-Type: application/json" \ -d '{"to":"Halloween","type":"task_delegation","content":"Build X","report_to":"October"}'

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README publishes a concrete relay authentication token, which is effectively a shared secret for accessing the relay API. Even if presented as an example, embedding a realistic token in public documentation encourages reuse, leaks credentials to anyone with repository access, and can enable unauthorized message submission to the orchestration channel.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 93% confidence
Finding: The protocol normalizes autonomous decision-making by stating there should be no approval bottlenecks and that humans are only sparring partners. In a system capable of delegation, execution, and relay messaging, this increases the likelihood of unauthorized or unsafe actions being taken without sufficient human review.
Content: Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.
md
## Core Principle **Optimal human-agent collaboration: humans spar, agents drive.** No approval bottlenecks. Continuous information flow. Goal: full autonomy through continuous improvement. ## The Human Role: Sparring Partner

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The protocol explicitly says 'agents drive' and rejects approval bottlenecks, encouraging autonomous action without explicit user opt-in or risk-based gating. In an agent skill, this can lead to overreach, especially when combined with task routing, delegation, relay messaging, and execution steps that may affect systems or data.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The protocol's emphasis on continuous information flow, coupled with agent-driven execution, creates a real risk that user-provided or system-derived sensitive data will be broadly propagated among agents and retained without minimization. In multi-agent systems, unrestricted sharing increases exposure surface and makes later containment difficult.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The lifecycle requires summaries and file logs for all work but does not limit what may be recorded, creating a persistence channel for sensitive prompts, credentials, personal data, or proprietary outputs. This is dangerous because operational logs often outlive the task and are accessible beyond the original execution context.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill exposes a hardcoded relay authentication token in plain text, which can be reused by any reader to send or retrieve messages from the local relay service. Even if bound to localhost, this creates credential leakage risk, enables unauthorized inter-agent message injection, and normalizes unsafe secret-handling practices in operational documentation.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Daily logs and communication audit files encourage persistent recording of inter-agent exchanges and task data, but no safeguards are specified for storage, retention, access control, or redaction. This can expose sensitive operational context and user data through accumulated audit artifacts.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.
md
|------|-------| | Daily logs | `memory/daily-logs/YYYY-MM-DD.md` | | Agent comm audit | `memory/agent-comm-logs/YYYY-MM-DD.jsonl` | | This protocol | `skills/swarm-workflow-protocol/SKILL.md` | ## Anti-Patterns

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: README.md:37

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:73