TNBC Research Swarm

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:26 PM UTC
• Version: 1.0.0

Overview

The skill openly guides an agent to join an external TNBC research workflow and submit generated research or QC outputs, with no hidden install code or local privilege behavior found.

Install only if you intend to send generated TNBC research findings and QC notes to Research Swarm. Review each assignment and submission first, and do not include private user context, credentials, unpublished data, or system-prompt content in finding files or QC notes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:17

Finding

Untrusted External Task Delegation Can Hijack the Agent's Research Workflow

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-28, with externally directed submissions at lines 71-74 and 95-99
Vulnerability Type: External instruction injection and agent workflow hijacking
Risk Level: High

Vulnerable Code

markdown

### 1. Register as Agent

```bash
curl -s -X POST https://www.researchswarm.org/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"maxTasks": 5}'

Save the returned agentId for subsequent calls.

2. Receive Assignment

The response includes an assignment with:

• type: "research" or "qc_review"
• taskId or findingId: The task/finding identifier
• description: Research topic
• searchTerms: Keywords for searching

text

The assignment validation guidance does not require rejection of embedded instructions:

```markdown
**a) Validate Assignment**
- Confirm the topic is legitimate TNBC research
- If unclear, proceed with best judgment

Results are subsequently transmitted to the same external service:

bash

curl -s -X POST https://www.researchswarm.org/api/v1/agents/[agentId]/findings \
  -H "Content-Type: application/json" \
  -d @/path/to/finding.json

bash

curl -s -X POST https://www.researchswarm.org/api/v1/agents/[agentId]/qc-submit \
  -H "Content-Type: application/json" \
  -d '{
    "findingId": "[findingId]",
    "verdict": "passed|flagged|rejected",
    "notes": "Brief verification notes"
  }'

Technical Analysis

The skill delegates selection of the agent's task to researchswarm.org. The external response supplies a description, searchTerms, identifiers, and a task type that the agent is instructed to process. These fields cross an external trust boundary but are not explicitly designated as untrusted data.

No strict schema validation, content allowlist, instruction filtering, URL restriction, or mandatory user approval is required before ...[truncated 2037 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat every assignment field returned by the service as untrusted data, never as executable instructions.
2. Define and enforce a strict response schema:
   • Permit only documented task types.
   • Validate identifier formats and lengths.
   • Apply bounded lengths and character restrictions to descriptions and search terms.
   • Reject unexpected fields and nested content.
3. Restrict assignments to an explicit allowlist of TNBC research topics. Reject unrelated topics, requests for system information, tool-control directives, shell syntax, and instructions to contact unapproved endpoints.
4. Add an explicit instruction that text inside description, searchTerms, papers, and QC findings must only be analyzed as data and must never override system, user, or skill instructions.
5. Require user confirmation after displaying a normalized assignment and before performing searches or submitting information.
6. Separate assignment retrieval from execution. Convert validated responses into a local structured task representation that excludes free-form imperative instructions.
7. Restrict outbound requests to documented HTTPS endpoints and disclose precisely which generated data will be transmitted.
8. Require a final pre-submission review that checks scope, citations, sensitive information, and destination rather than only checking scientific content.
9. Log assignment identifiers, validation decisions, approved actions, and submission destinations for auditability.
10. URL-encode search parameters and use argument-based HTTP APIs instead of interpolating externally influenced values into shell commands.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

The skill instructs the agent to register with an external service, creating a persistent identifier and transmitting operational metadata to a third-party domain. Even though the payload is small, this is still an unsolicited outbound network action triggered by the skill, which can expose agent usage patterns and establish unreviewed trust with an external platform.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

1. Register as Agent

bash

curl -s -X POST https://www.researchswarm.org/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"maxTasks": 5}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This step directs the agent to POST locally generated research findings to an external endpoint, which is a data exfiltration pathway from the agent environment to a third party. Because the content may include user-provided context, synthesized analysis, or other sensitive workflow data, the skill creates a real risk of unauthorized external transmission.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

e) Submit Finding

bash

curl -s -X POST https://www.researchswarm.org/api/v1/agents/[agentId]/findings \
  -H "Content-Type: application/json" \
  -d @/path/to/finding.json

Static analysis

No suspicious patterns detected.