T09 · Insecure Skill Coding Practices
Error
- Location
scripts/swarm_runner.py:98- Finding
Arbitrary Environment Secret Disclosure Through a Configurable API Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawSwarm
Security checks for vulnerabilities and agentic risk
Overview
This forecasting skill does what it claims, but its configurable API endpoint can expose chosen environment secrets and prompt data if a user runs an unsafe config.
Review this before installing if you may run configs from other people or use sensitive environment variables. Only run configs you trust, avoid direct api_key values in shared files, prefer official provider URLs or local Ollama, and keep agent counts and delays within a deliberate budget.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/swarm_runner.py:74- Finding
Unbounded Agent Expansion and API Execution Permit Resource Exhaustion
- Content
View full analysis
1 else t_min agents.append({ 'role': group['role'], 'model': group.get('model'), 'temperature': round(t, 3), 'index': len(agents) }) return agents ``` ```python def run_swarm(config, dry_run=False): """Run the full swarm prediction pipeline.""" target = config['target'] api_config = config.get('api', {}) consensus_config = config.get('consensus', {}) delay_ms = api_config.get('delay_ms', 1200) agents = build_agents(config) total = len(agents) predictions = [] ok, fail = 0, 0 for i, agent in enumerate(agents): result = call_llm(agent, target, api_config) if result: anchor = target['current_price'] max_dev = consensus_config.get( 'max_deviation', 0.15 ) if abs(result['price'] - anchor) / anchor <= max_dev: predictions.append(result) ok += 1 else: fail += 1 else: fail += 1 if i < total - 1: time.sleep(delay_ms / 1000.0) ``` ### Technical Analysis Configuration values are used without schema validation or upper bounds. In particular, each agent group's `count` is passed directly to `ra ...[truncated 2187 chars]- Remediation
View remediation
MAX_TOTAL_AGENTS: raise ValueError("Total agent count is outside the allowed range") ``` 5. Constrain delay values: ```python if not isinstance(delay_ms, (int, float)): raise ValueError("delay_ms must be numeric") if delay_ms < 0 or delay_ms > 60000: raise ValueError("delay_ms must be between 0 and 60000") ``` 6. Consider generating agents lazily instead of materializing the complete list in memory. 7. Add global execution controls such as: - Maximum wall-clock duration. - Maximum failed-request count. - Maximum retry count. - Maximum API spend or token budget. - Graceful cancellation support. 8. Reject non-finite numeric values such as `NaN` and infinity throughout the configuration and consensus input. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises executable usage that implies shell execution, file reads, environment variable access, and outbound network access, but it does not declare any explicit tool scope or permissions boundary. That omission can cause an agent or user to run the skill with broader capabilities than expected, increasing the risk of unintended command execution, data exposure from local files/env vars, or uncontrolled external requests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill encourages sending target names, prices, and free-form context to external LLM providers, but the description does not warn users that this data leaves the local environment. In practice, users may include proprietary trading signals, internal research, or sensitive market context, creating an avoidable confidentiality and compliance risk when transmitted to third-party APIs.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python provider: groq # groq | openai | ollama model: llama-3.3-70b-versatile api_key_env: GROQ_API_KEY # env var name base_url: https://api.groq.com/openai/v1/chat/completions # optional override max_tokens: 150 delay_ms: 1200 # delay between requests
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python provider: groq # groq | openai | ollama model: llama-3.3-70b-versatile api_key_env: GROQ_API_KEY # env var name base_url: https://api.groq.com/openai/v1/chat/completions # optional override max_tokens: 150 delay_ms: 1200 # delay between requests
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The function transmits target data, free-form context, and bearer credentials to a configurable remote endpoint, including an arbitrary base_url override, without any trust boundary checks, allowlisting, or prominent disclosure to the user at execution time. In a skill that may process proprietary market context or internal forecasting data, this creates a real exfiltration risk and can also leak API keys to attacker-controlled endpoints if the config is modified.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python base_urls = { 'groq': 'https://api.groq.com/openai/v1/chat/completions', 'openai': 'https://api.openai.com/v1/chat/completions', 'ollama': 'http://localhost:11434/v1/chat/completions', } url = api_config.get('base_url') or base_urls.get(provider, base_urls['groq'])
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This POST sends the assembled prompt content, including target name, current price, and arbitrary context, to an external service. Because the destination can be overridden by configuration and the same request may include a bearer token, the call can become a data and credential exfiltration channel if the config is malicious or careless.
- Content
python try: if HAS_REQUESTS: r = requests.post(url, json=payload, headers=headers, timeout=30) r.raise_for_status() data = r.json() else:
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python consensus_script = Path(__file__).parent / 'consensus.py' if consensus_script.exists(): try: proc = subprocess.run( [sys.executable, str(consensus_script)], input=json.dumps(consensus_input), capture_output=True, text=True, timeout=10
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file documents both an environment-variable key and a direct
api_keyfield, but it does not warn users that putting API keys directly into config files can expose secrets through source control, logs, or shared files. Because this is a skill description file and the documented behavior affects credential privacy, a brief warning is warranted.- Content
Static analysis
No suspicious patterns detected.