T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:517- Finding
Agents Are Executed with Approval and Sandbox Protections Disabled
- Content
View full analysis
- Remediation
View remediation
Security audit
Coding Swarm Agent
Security checks for vulnerabilities and agentic risk
Overview
This is a powerful multi-agent automation skill that is mostly coherent, but it uses unsafe default privileges, automatic Git pushes, and persistent hooks that can affect future repository work.
Review before installing. Use only in an isolated repository or disposable environment without secrets, remove the dangerous bypass flags, avoid auto-push/force-commit defaults, inspect or back up any existing Git hooks, and uninstall the post-commit hook after the workflow ends.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)
T06 · System Persistence
Error
- Location
scripts/install-hooks.sh:25- Finding
Persistent Git Post-Commit Hook Is Installed Without Preserving Existing Hooks
- Content
View full analysis
~/.openclaw/workspace/swarm/project-dir # Write the post-commit hook cat > "$HOOKS_DIR/post-commit" << 'HOOK' #!/bin/bash ... # Auto-push (background) git push 2>/dev/null & # Wake OpenClaw orchestrator via webhook HOOK_TOKEN=$(cat "$HOME/.openclaw/workspace/swarm/hook-token" 2>/dev/null || echo "") NOTIFY_TARGET=$(cat "$HOME/.openclaw/workspace/swarm/notify-target" 2>/dev/null || echo "") if [[ -n "$HOOK_TOKEN" ]]; then curl -s -X POST http://127.0.0.1:18789/hooks/wake \ -H "Authorization: Bearer $HOOK_TOKEN" \ -H "Content-Type: application/json" \ -d "{\"text\":\"Swarm commit: $COMMIT_HASH — $COMMIT_MSG\",\"mode\":\"now\"}" >/dev/null 2>&1 & fi ... HOOK chmod +x "$HOOKS_DIR/post-commit" ``` ### Technical Analysis The installer writes an executable `.git/hooks/post-commit` file that survives the current Skill invocation and runs on future commits. Its behavior includes dependency execution, branch mutation through `git reset --soft`, automatic Git pushes, local webhook requests, and Telegram notifications. The installation uses direct redirection to `post-commit`, so any pre-existing hook is overwritten rather than backed up or chained. Activation depends on a shared `~/.openclaw/workspace/swarm/active-tasks.json` file containing text matching `"running"` or `"reviewing"`, rather than a repository-specific authenticated batch association. Consequently, stale or unrelated swarm state can cause the persistent hook to act during later repository work. ### Attack Path 1. A user follows the documented setup and invokes `install-hooks.sh` for a repository. 2. The script replaces `.git/hooks/post-commit` with the Skill's persistent hook. 3. The original swarm run ...[truncated 1007 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/dispatch.sh:238- Finding
Force-Commit Logic Can Stage and Push Secrets or Unrelated User Changes
- Content
View full analysis
/dev/null)" ]; then git -C "${WORKDIR}" add -- . ':!../../swarm/' ':!../../reports/' ':!../../memory/' \ 2>/dev/null || git -C "${WORKDIR}" add -A if [ -n "$(git -C "${WORKDIR}" diff --cached --name-only 2>/dev/null)" ]; then git -C "${WORKDIR}" commit -m "feat: ${TASK_ID} auto-commit (agent forgot)" \ && git -C "${WORKDIR}" push \ || FC_EC=$? fi fi ``` The Skill also declares automatic push as a core rule in `SKILL.md:25-27`: ```markdown 3. **Every commit pushes immediately.** `git add -A && git commit -m "..." && git push` ``` ### Technical Analysis The fallback stages the entire current working tree rather than only files assigned to the dispatched task. If the first staging command fails, it explicitly falls back to `git add -A`, which stages tracked modifications, deletions, and untracked files throughout the repository. The three path exclusions are relative pathspecs and do not protect conventional sensitive files such as `.env`, private keys, cloud configuration, database exports, debug logs, or arbitrary files created by another user or process. After staging, the code commits and immediately pushes without a secret scan, scope validation, diff review, or human approval. Because multiple agents and humans may share the main branch and working tree, the force-commit can also capture changes made concurrently by a different actor. ### Attack Path 1. A sensitive or unrelated file exists in the repository working tree and is not covered by `.gitignore`. 2. An agent task makes any additional change or exits while the worktree remains dirty. 3. The force-commit fallback detects the dirty wor ...[truncated 1016 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/milestone-check.sh:22- Finding
Unquoted Python Heredoc Enables Local Code Injection Through Persisted Values
- Content
View full analysis
/dev/null || echo "") NOTIFY_TARGET=$(cat "$SWARM_DIR/notify-target" 2>/dev/null || echo "") PROJECT_DIR=$(cat "$SWARM_DIR/project-dir" 2>/dev/null || echo "") # Run Python to determine if any milestone is newly complete python3 - < ~/.openclaw/workspace/swarm/project-dir ``` ### Technical Analysis The heredoc delimiter is unquoted, so the shell expands parameter substitutions before Python parses the program. Values read from files and command arguments are inserted inside Python string literals without escaping. A value containing a double quote, newline, backslash sequence, or valid Python statements can terminate the intended string and inject additional Python source. This affects at least `PROJECT_DIR`, `HOOK_TOKEN`, and `NOTIFY_TARGET`. The project path is particularly relevant because Git repositories can reside in paths containing quotes and other special characters, and `install-hooks.sh` stores the path without validation. Using a subprocess argument list later in the Python code does not mitigate this issue because exploitation occurs while construc ...[truncated 1341 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate-image.sh:143- Finding
Image Generation Accepts Arbitrary Output Paths and Overwrites Files
- Content
View full analysis
&2 exit 1 fi if [[ -n "$BACKEND" ]] && ! validate_backend "$BACKEND"; then echo "❌ Unknown backend: '$BACKEND'. Allowed: ${ALLOWED_BACKENDS[*]}" >&2 BACKEND="stub" fi BACKEND="$(resolve_default_backend)" if ! validate_backend "$BACKEND"; then echo "❌ Unknown backend: '$BACKEND'. Allowed: ${ALLOWED_BACKENDS[*]}" >&2 BACKEND="stub" fi mkdir -p "$(dirname "$OUTPUT")" call_backend_safe if [[ -f "$OUTPUT" ]]; then echo "✅ Image generated: $OUTPUT" return 0 fi ``` The OpenAI backend performs the final overwrite at `scripts/backends/openai.sh:62`: ```bash curl -fsS -o "$OUTPUT" "$URL" ``` ### Technical Analysis The backend name is allowlisted, but the output path is not. The script accepts absolute paths, traversal sequences, and paths outside the project. It creates parent directories and passes the path to a backend that overwrites the destination. There is no canonical-path containment check, symlink rejection, existing-file protection, extension enforcement, or safe exclusive file creation. Because the documented agent commands disable sandboxing, a prompt-controlled invocation can target any path writable by the invoking user. The issue is acknowledged in `SKILL.md:589-590`, but the claimed sandbox-based risk reduction does not apply to the documented execution configuration. ### Attack Path 1. An attacker influences a task or prompt that requests image generation. 2. The agent invokes `generate-image.sh` with an output such as an absolute user-configuration path or a traversal path outside the intended artifact directory. 3. `mkdir -p` creates any missing parent directories the user can create. 4 ...[truncated 1000 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/install-hooks.sh:44- Finding
Persistent Hook Executes Project-Controlled Dependencies Through npx
- Content
View full analysis
&1) || { # Filter out pre-existing errors (like @types/pg missing) vs new errors # Count errors in changed files only NEW_ERRORS="" for f in $(git diff-tree --no-commit-id --name-only -r HEAD | grep "^$subdir/"); do REL_FILE="${f#$subdir/}" FILE_ERRORS=$(echo "$TSC_OUTPUT" | grep "^$REL_FILE" || true) ``` ```bash if [[ -n "$CHANGED_WEB_FILES" ]] && [[ -f "polygo-web-admin/package.json" ]]; then # Build file list relative to polygo-web-admin/ REL_FILES=$(echo "$CHANGED_WEB_FILES" | sed 's|^polygo-web-admin/||' | tr '\n' ' ') ESLINT_OUTPUT=$(cd polygo-web-admin && npx eslint --max-warnings=0 $REL_FILES 2>&1) || { ESLINT_FAILED=true ``` ### Technical Analysis The persistent post-commit hook executes `npx tsc` and `npx eslint` from project directories. These commands resolve binaries from repository-controlled dependencies and, depending on the local npm/npx configuration and dependency state, may install missing packages from a registry. JavaScript package installation and execution can run package binaries and lifecycle scripts. The hook does not require a verified lockfile state, disable automatic package installation, pin an exact package identity, or isolate execution from user credentials and the network. A repository with compromised dependencies or manipulated package metadata can therefore cause code execution when a commit triggers the hook. This execution occurs automatically as part of Git commit processing, which may make the action appea ...[truncated 1165 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (118)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's declared purpose understates several powerful actions: installing git hooks, auto-pushing to remotes, emitting events, writing signal files, and sending external notifications. In an orchestration context, these hidden operational side effects materially increase risk because a user may invoke the skill expecting coordination only, not repository mutation and outbound communications.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's declared purpose understates several powerful actions: installing git hooks, auto-pushing to remotes, emitting events, writing signal files, and sending external notifications. In an orchestration context, these hidden operational side effects materially increase risk because a user may invoke the skill expecting coordination only, not repository mutation and outbound communications.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's declared purpose understates several powerful actions: installing git hooks, auto-pushing to remotes, emitting events, writing signal files, and sending external notifications. In an orchestration context, these hidden operational side effects materially increase risk because a user may invoke the skill expecting coordination only, not repository mutation and outbound communications.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's declared purpose understates several powerful actions: installing git hooks, auto-pushing to remotes, emitting events, writing signal files, and sending external notifications. In an orchestration context, these hidden operational side effects materially increase risk because a user may invoke the skill expecting coordination only, not repository mutation and outbound communications.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill's declared purpose understates several powerful actions: installing git hooks, auto-pushing to remotes, emitting events, writing signal files, and sending external notifications. In an orchestration context, these hidden operational side effects materially increase risk because a user may invoke the skill expecting coordination only, not repository mutation and outbound communications.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill's declared purpose understates several powerful actions: installing git hooks, auto-pushing to remotes, emitting events, writing signal files, and sending external notifications. In an orchestration context, these hidden operational side effects materially increase risk because a user may invoke the skill expecting coordination only, not repository mutation and outbound communications.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill's declared purpose understates several powerful actions: installing git hooks, auto-pushing to remotes, emitting events, writing signal files, and sending external notifications. In an orchestration context, these hidden operational side effects materially increase risk because a user may invoke the skill expecting coordination only, not repository mutation and outbound communications.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill's declared purpose understates several powerful actions: installing git hooks, auto-pushing to remotes, emitting events, writing signal files, and sending external notifications. In an orchestration context, these hidden operational side effects materially increase risk because a user may invoke the skill expecting coordination only, not repository mutation and outbound communications.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill's declared purpose understates several powerful actions: installing git hooks, auto-pushing to remotes, emitting events, writing signal files, and sending external notifications. In an orchestration context, these hidden operational side effects materially increase risk because a user may invoke the skill expecting coordination only, not repository mutation and outbound communications.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill's declared purpose understates several powerful actions: installing git hooks, auto-pushing to remotes, emitting events, writing signal files, and sending external notifications. In an orchestration context, these hidden operational side effects materially increase risk because a user may invoke the skill expecting coordination only, not repository mutation and outbound communications.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill asserts that the orchestrator must never touch project files, but later instructs it to write requirements, design, plan, and swarm prompt files under project-repo docs paths. Contradictory safety boundaries are dangerous because operators and downstream agents cannot reliably determine what writes are allowed, enabling accidental repo mutation despite a supposedly strict non-touch policy.
- Content
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 93% confidence
- Finding
This dispatch example explicitly invokes an external model with
--permission-mode bypassPermissions, which weakens safety boundaries for downstream agent actions. In this skill's context, that agent can be tasked with repository changes and operational workflows, so bypassing permission checks materially increases the chance of unsafe code execution or unauthorized file modification.- Content
md # Step 3: dispatch（用 --prompt-file，不用手动转义） $SKILL_DIR/scripts/dispatch.sh cc-frontend FIX-XXX --prompt-file /tmp/fix-xxx-prompt.txt \ claude --model claude-sonnet-4-6 --permission-mode bypassPermissions \ --no-session-persistence --print --output-format json # DEPLOY-XXX 在 FIX-XXX 完成后自动解锁为 pending；orchestrator 被事件唤醒后 dispatch DEPLOY-XXX
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
The cc-plan dispatch example uses an external provider with
bypassPermissions, normalizing high-trust execution for planning tasks. Even planning agents in this system can access project context and produce artifacts that steer later code or deployment actions, so the unsafe default broadens systemic risk.- Content
md # Use --output-format json so parse-tokens.sh can extract usage stats from the log. # dispatch.sh wraps the command with `tee LOG_FILE`, so LOG_FILE contains the JSON blob. $SKILL_DIR/scripts/dispatch.sh cc-plan T000 --prompt-file "$PROMPT_FILE" \ claude --model claude-opus-4-6 --permission-mode bypassPermissions \ --no-session-persistence --print --output-format json # cc-review / cc-frontend — sonnet
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
The review agent example sends code/material to an external model while bypassing permissions. Since review output can approve or reject sensitive changes, compromising safeguards here can affect integrity of the whole workflow and expose repository content to an external service.
- Content
md # cc-review / cc-frontend — sonnet $SKILL_DIR/scripts/dispatch.sh cc-review T005 --prompt-file "$PROMPT_FILE" \ claude --model claude-sonnet-4-6 --permission-mode bypassPermissions \ --no-session-persistence --print --output-format json $SKILL_DIR/scripts/dispatch.sh cc-frontend T010 --prompt-file "$PROMPT_FILE" \ claude --model claude-sonnet-4-6 --permission-mode bypassPermissions \
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
The frontend agent is launched against an external provider with
bypassPermissions, again setting an insecure default. Because this skill encourages automated dispatch and parallel work, unsafe provider invocation can scale mistakes across multiple tasks quickly.- Content
md claude --model claude-sonnet-4-6 --permission-mode bypassPermissions \ --no-session-persistence --print --output-format json $SKILL_DIR/scripts/dispatch.sh cc-frontend T010 --prompt-file "$PROMPT_FILE" \ claude --model claude-sonnet-4-6 --permission-mode bypassPermissions \ --no-session-persistence --print --output-format json # Codex — standard task (high effort, default)
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 97% confidence
- Finding
The Codex example uses
--dangerously-bypass-approvals-and-sandbox, explicitly disabling both approval gates and sandbox protections. In a skill that can edit repositories, run git commands, install hooks, and participate in deploy chains, this creates a direct path to unrestricted execution and filesystem/repository impact.- Content
md # Codex — standard task (high effort, default) $SKILL_DIR/scripts/dispatch.sh codex-1 T001 --prompt-file "$PROMPT_FILE" \ codex exec -c model_reasoning_effort=high --dangerously-bypass-approvals-and-sandbox # Codex — retry / complex task (extra-high effort) $SKILL_DIR/scripts/dispatch.sh codex-1 T001 --prompt-file "$PROMPT_FILE" \
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 97% confidence
- Finding
This retry example preserves the same dangerous bypass flags while increasing reasoning effort, which can embolden a more capable agent under fewer controls. The combination raises the potential for broad unauthorized actions if prompts are malformed or adversarially influenced.
- Content
md # Codex — retry / complex task (extra-high effort) $SKILL_DIR/scripts/dispatch.sh codex-1 T001 --prompt-file "$PROMPT_FILE" \ codex exec -c model_reasoning_effort=extra-high --dangerously-bypass-approvals-and-sandbox # Codex — simple/boilerplate task (medium effort, faster) $SKILL_DIR/scripts/dispatch.sh codex-1 T001 --prompt-file "$PROMPT_FILE" \
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 97% confidence
- Finding
Even for 'simple' tasks, the example uses
--dangerously-bypass-approvals-and-sandbox, making unsafe execution the baseline rather than an exception. Low-complexity tasks are common, so this default greatly magnifies aggregate risk across routine operations.- Content
Codex — simple/boilerplate task (medium effort, faster)
$SKILL_DIR/scripts/dispatch.sh codex-1 T001 --prompt-file "$PROMPT_FILE"
codex exec -c model_reasoning_effort=medium --dangerously-bypass-approvals-and-sandboxtext ### Read agent output
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### H4 — dispatch.sh force-commit：git add -A 有安全风险 **问题：** agent 忘记 commit 时，runner script 执行 `git add -A`， 会把 `.env`、`config/secrets.json` 等未被 .gitignore 覆盖的敏感文件一起推送到远端 repo。 **期望：** 改为 `git add -u`（只 stage 已跟踪文件的修改，不添加新文件）， 避免意外推送敏感文件。force-commit 的 commit message 里注明这是 fallback。
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document promotes highest-permission agent execution with no confirmation prompts and no strong user-facing safety warning. In the context of a workflow orchestrator that can edit code, run shell commands, push commits, and deploy services, disabling confirmations removes a critical containment layer and magnifies the blast radius of prompt injection, agent mistakes, or malicious task content.
- Content
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
The template hardcodes an external model invocation (
claude) with bypassed permissions for a task that can read repository content and later write files and push commits. In a workflow-orchestrator skill, external provider selection becomes more dangerous because it can route sensitive workspace data through another model/provider and pair that with elevated execution privileges.- Content
调用命令格式
bash claude --permission-mode bypassPermissions --no-session-persistence --print 'PROMPT'
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The prompt grants unconditional repository-wide mutation and remote push capability that is not necessary for producing an analysis memo. Combined with
git add -A, this can sweep unrelated changes into a commit and publish them externally, increasing the blast radius from a single document task to full-repository impact.- Content
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 97% confidence
- Finding
The template hardcodes use of an external model CLI (claude) together with bypassPermissions, encouraging offloading repository context and task execution to an external agent under reduced safeguards. In this skill context, which orchestrates coding agents and writes to the repo, that combination materially raises risk of sensitive data exposure, unreviewed code changes, and execution of unsafe instructions inherited from adversarial project content.
- Content
调用命令格式
bash claude --permission-mode bypassPermissions --no-session-persistence --print 'PROMPT'
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 93% confidence
- Finding
The skill hardcodes use of an external model invocation with bypassed permissions, coupling provider/tool selection to an unsafe execution posture. This is more dangerous in this skill context because the agent is framed as a writing assistant, yet it is empowered to perform privileged local actions through an external CLI without clear review boundaries.
- Content
调用命令格式
bash claude --permission-mode bypassPermissions --no-session-persistence --print 'PROMPT'
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The prompt claims scope is limited to
output_file, but also instructs creation of image files in a siblingimages/directory and later repository-wide git operations. This contradiction weakens operator expectations and increases the chance of unintended file modification or publication outside the stated scope.- Content
Static analysis
No suspicious patterns detected.