Security audit

Coding Swarm Agent

Security checks for vulnerabilities and agentic risk

Overview

This is a real multi-agent coding workflow, but it grants agents broad unsandboxed authority to auto-commit, push, install persistent hooks, and deploy, so it needs careful review before use.

Install only in an isolated, trusted repository where automatic commits, pushes, git hooks, Telegram notifications, local webhooks, and deployment commands are acceptable. Review and disable the post-commit hook, auto-push paths, and bypass-sandbox command examples unless you explicitly want that level of automation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (38)

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The skill states that the orchestrator never touches project files, then later instructs it to write requirements/design/planning artifacts inside the project repository. Contradictory safety boundaries are dangerous because operators may rely on the stricter statement while the workflow actually authorizes repo writes.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The role-definition section forbids project-directory writes and exec usage, but later workflow steps instruct creating files in the repo and running project-scoped commands like hook installation, git diff, revert, and other repo operations. These contradictory instructions weaken control boundaries and can enable unintended code execution and repository mutation under the guise of orchestration.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The template is for producing an analysis document, but it also instructs the agent to run `git add -A && git commit ... && git push`, which grants repository-wide side effects unrelated to the requested task. In an agent workflow context, this can cause unintended staging of unrelated files, permanent history changes, and publication of content to a remote without an explicit user approval step.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The prompt says not to modify files outside `output_file`, but later tells the agent to stage all files and commit/push them. That contradiction is dangerous because `git add -A` captures any incidental or preexisting workspace changes, defeating the stated scope boundary and enabling broad, hard-to-review repository modifications.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The template instructs operators to launch Claude with `--permission-mode bypassPermissions`, which disables normal safety/approval boundaries for a task whose stated purpose is only code review. In a multi-agent workflow skill, this creates unnecessary privilege expansion: any prompt injection, mistaken instruction, or review-time task creep could cause unrestricted file, shell, or repository actions.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The review prompt tells reviewers to directly fix small issues and commit them, expanding the role from analysis into code modification. That increases the blast radius of a review agent: a prompt intended to assess output can instead alter the repository, making accidental changes, malicious prompt-driven edits, or unreviewed commits more likely.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: Requiring the agent to place a field report into the git commit message body introduces repository-modifying behavior into what should be a review template. In this skill context, that encourages agents to create or amend commits during review, increasing the chance of unauthorized history changes, metadata leakage, or audit noise unrelated to the user's request.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The template explicitly states that cc-writing is only responsible for organizing and producing document content, but then grants it operational behavior to invoke an external image-generation script and create additional files under an images directory. That expands the skill from pure writing into tool execution and filesystem mutation, increasing attack surface and making prompt-triggered side effects possible from document content such as DIAGRAM placeholders.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The prompt says scope should be limited to output_file, but later instructs broad repository actions via git add -A, commit, and push. This directly contradicts the claimed boundary and can sweep unrelated changes into a commit and publish them remotely, which is especially dangerous in an orchestrator skill that may run with broad repo access.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: A writing-focused prompt does not need authority to commit and push repository changes, yet the template instructs exactly that. In context, this skill is part of a multi-agent workflow system, so embedding autonomous VCS publication behavior meaningfully increases the chance of unauthorized code/document changes being propagated to shared remotes.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The template authorizes execution of an external shell script for image generation even though the skill is described as writing-only. This creates an unnecessary subprocess execution path from prompt-controlled content, which can cause unintended external actions, extra file creation, and dependency on unreviewed local scripts.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The template explicitly instructs operators to run Codex with `--dangerously-bypass-approvals-and-sandbox`, which disables key containment and review controls before executing deployment actions. In this skill context, that is especially risky because the same prompt then performs git operations, filesystem writes, rsync deletion, service reloads, and local environment inspection, so a malformed prompt or compromised task could directly affect the host system.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The file goes beyond workflow orchestration and provides an operational runbook for building, copying artifacts into a live web root, reloading Nginx, and verifying deployment. That expansion of scope increases risk because an agent intended for coordination is being equipped to make production-like system changes directly on the host.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The prompt explicitly instructs running `codex exec` with `--dangerously-bypass-approvals-and-sandbox`, which disables key execution safeguards for a task that should only create tests and run verification commands. In the context of a workflow orchestrator that delegates work to agents, this creates unnecessary authority for filesystem, command, and repo actions, increasing the chance of destructive or unintended behavior if the prompt or downstream context is compromised.

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: The prompt says the agent must not write business code, but later allows modifying `scripts/verify-*.ts`, which weakens the integrity of the acceptance process because a failing verification script could be changed to pass. That contradiction can let an agent satisfy the workflow by altering the checker rather than validating the milestone, undermining trust in the test results.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The dispatch script does more than dispatch work: it automatically stages, commits, and pushes any uncommitted repository changes from the current working directory after the agent command finishes. In a workflow orchestrator that executes agent-generated actions, this creates an unsafe remote mutation path where unintended, low-quality, or malicious changes can be published without explicit operator review or confirmation.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script contains built-in remote repository mutation capability via `git push` in a generic dispatch path, not a dedicated release or review flow. Because this skill orchestrates autonomous coding agents, any agent-produced changes can be propagated to the remote repository automatically, increasing the risk of supply-chain compromise, branch corruption, or exfiltration of unintended content.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The script explicitly installs a post-commit hook that can revert commits, auto-push to remotes, write persistent signals, and trigger notifications/webhooks. Those are real autonomous repository mutations and side effects that extend beyond passive workflow orchestration, increasing the chance of unintended code publication or disruptive repository state changes.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The installed hook persists inside .git/hooks and continues running on every commit, while also sending data to local webhooks and Telegram via the openclaw CLI. Persistent hooks plus external signaling create an ongoing automation channel that can surprise users, leak commit metadata, and continue operating after the original task is forgotten.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The script sends a generic agent-hook payload that can trigger broader autonomous actions beyond a narrow codex-test invocation, including Telegram delivery and instructions to modify task state and dispatch further work. In a workflow-orchestrator skill, this expands the trust boundary from local milestone checking to remote agent execution, increasing the chance of unintended actions if milestone metadata, notify-target, or hook configuration are manipulated.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The documented commands explicitly use `--dangerously-bypass-approvals-and-sandbox` and Claude permission bypass modes without prominent risk warnings or strong gating. This materially lowers execution safeguards for autonomous coding agents that can edit repositories, run commands, and perform git operations, increasing the chance of destructive or malicious actions.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The playbook documents fully automated task dispatch, review, testing, and deployment behavior, including automatic state transitions and downstream execution, but does not pair these capabilities with an explicit warning about repository, infrastructure, and data impact. In the context of an agent-orchestration skill, this omission materially increases the chance that users enable autonomous changes, pushes, reverts, and deployments without understanding the operational risk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The document instructs users to store notification and webhook secrets in predictable local files and configuration without giving explicit guidance on file permissions, rotation, redaction, or avoiding accidental inclusion in logs or repositories. For an automation system that triggers events and external messaging, weak credential-handling guidance can lead to token disclosure and unauthorized triggering of hooks or notification abuse.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The template directs the agent to write output to `output_file`, but it does not clearly disclose to the end user that running the skill will modify files. In a multi-agent coding workflow, implicit file writes can surprise users, overwrite important content, or be abused to place content in sensitive repository locations if `output_file` is not tightly validated.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The prompt includes commit and push commands without warning that they will alter repository history and publish changes to a remote. In this skill's orchestration setting, such hidden side effects are especially risky because agents may execute them automatically, turning a document-generation task into unauthorized persistence and exfiltration of repository content.

Static analysis

No suspicious patterns detected.