Security audit

SwarmSync Agent Registration

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it handles saved credentials in a way that could expose accounts or run unsafe local shell commands.

Review before installing. Use a dedicated SwarmSync account, avoid reusing passwords, do not run dry-run in logged environments, and inspect or remove ~/.openclaw/.env after use. The publisher should replace shell sourcing with strict parsing or secure secret storage before this is broadly trusted.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/register.sh:54
Finding: Remote-to-Local Command Execution Through Unsafe Credential File Sourcing
Content: View full analysis
\&, \ -> \\ (H-04 fix) local escaped_value escaped_value=$(printf '%s' "$value" | sed 's/[&\]/\\&/g') if [[ "$(uname -s)" == "Darwin" ]]; then sed -i '' "s|^${key}=.*|${key}=${escaped_value}|" "$ENV_FILE" else sed -i "s|^${key}=.*|${key}=${escaped_value}|" "$ENV_FILE" fi else printf '%s=%s\n' "$key" "$value" >> "$ENV_FILE" fi } ``` Remote API response fields are subsequently persisted: ```bash save_env "SWARMSYNC_ACCESS_TOKEN" "$ACCESS_TOKEN" save_env "SWARMSYNC_USER_ID" "$USER_ID" ``` ```bash save_env "SWARMSYNC_AGENT_ID" "$AGENT_ID" save_env "SWARMSYNC_AGENT_SLUG" "$LOCAL_SLUG" ``` ### Technical Analysis The script treats `~/.openclaw/.env` as both a data file and executable shell input. The `source` built-in evaluates every line using the current shell, including command substitutions, shell operators, function calls, redirections, and arbitrary commands. Several values written into this file originate from SwarmSync API responses. The `save_env` function does not serialize them as shell-safe literals or enforce strict field formats. Its escaping only ad ...[truncated 2071 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/register.sh:64
Finding: Credentials May Be Written to an Existing Overly Permissive File
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/register.sh:98
Finding: Dry-Run Mode Discloses Stored Passwords in Diagnostic Output
Content: View full analysis
Remediation: View remediation
"`. 6. Review all failure and debugging paths to ensure API responses and headers cannot expose tokens. 7. Document that secrets must not be emitted to logs, agent transcripts, or CI artifacts. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (27)

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The skill states that credentials are saved to ~/.openclaw/.env, a plaintext local file likely accessible to other local processes, users, backups, or tooling. Storing passwords and access tokens in plaintext materially increases the chance of credential theft and account takeover.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
Slug: [your-agent-slug] Marketplace: https://swarmsync.ai/marketplace/agents/[slug] AP2 endpoint: https://swarmsync-agents.onrender.com/agents/[slug]/run Credentials saved to: ~/.openclaw/.env

text
---

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: The script explicitly stores credentials and access tokens in ~/.openclaw/.env, creating a long-lived local secret store that may be readable by other local processes, backup systems, tooling, or later malicious skills. Persistent bearer tokens are especially sensitive because compromise can grant ongoing access to the external SwarmSync account and related agent-management actions.
Content: Scanner excerpt · scripts/register.sh (reported line 10)May include surrounding context.
sh
# SWARMSYNC_ACCESS_TOKEN, SWARMSYNC_AGENT_SLUG (read/write) # External endpoints called: https://api.swarmsync.ai/ (only) # Local files read: ~/.openclaw/workspace/SOUL.md (optional) # Local files written: ~/.openclaw/.env (credentials — append/update only) # # Usage: # bash register.sh # full registration flow

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/register.sh (reported line 15)May include surrounding context.
sh
# Usage: # bash register.sh # full registration flow # bash register.sh --login # login only (account exists) # bash register.sh --refresh # refresh access token # bash register.sh --dry-run # print what would be sent, no API calls # bash register.sh --status # check current registration status #

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: Defining ~/.openclaw/.env as the central credential file indicates the skill will read and write authentication material from a predictable plaintext location. In a multi-skill or semi-trusted local environment, predictable secret locations materially increase the risk of credential theft and account takeover.
Content: Scanner excerpt · scripts/register.sh (reported line 25)May include surrounding context.
sh
SWARMSYNC_API="https://api.swarmsync.ai" AGENTS_GATEWAY="https://swarmsync-agents.onrender.com" MARKETPLACE_URL="https://swarmsync.ai/marketplace/agents" ENV_FILE="$HOME/.openclaw/.env" SOUL_FILE="$HOME/.openclaw/workspace/SOUL.md" DRY_RUN=false MODE="register" # register | login | refresh | status

Credential Access

High

Category: Privilege Escalation
Confidence: 98% confidence
Finding: Sourcing ~/.openclaw/.env executes the file as shell code, not merely parsing key/value pairs. If that file is modified by another local process or malicious skill, running this script can trigger arbitrary command execution under the user's account while also loading stolen or attacker-controlled credentials.
Content: Scanner excerpt · scripts/register.sh (reported line 53)May include surrounding context.
sh
err() { echo "❌ $*" >&2; } bold() { echo ""; echo "── $* ──────────────────────────────────"; } # Load .env if it exists load_env() { if [[ -f "$ENV_FILE" ]]; then # shellcheck disable=SC1090

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The save routine persists authentication secrets to disk, increasing the blast radius from transient secrets to durable compromise. A later local compromise, log collection, sync service, or accidental file disclosure could expose email, password, access token, and agent identifiers.
Content: Scanner excerpt · scripts/register.sh (reported line 63)May include surrounding context.
sh
fi } # Save a key=value to ~/.openclaw/.env (create or update) save_env() { local key="$1" local value="$2"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/register.sh (reported line 324)May include surrounding context.
sh
AGENT_SLUG=$(echo "$AGENT_RESPONSE" | jq -r '.slug // empty') AGENT_ID=$(echo "$AGENT_RESPONSE" | jq -r '.id // empty') # H-02: Verify we received a valid slug before saving to .env if [[ -z "$AGENT_SLUG" ]] || [[ "$AGENT_SLUG" == "null" ]]; then err "Agent profile creation failed — no slug returned. Full response:" echo "$AGENT_RESPONSE" | jq '.'

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/register.sh (reported line 353)May include surrounding context.
sh
printf "║ %-58s ║\n" "$MARKETPLACE_URL/${SWARMSYNC_AGENT_SLUG:-unknown}" printf "║ %-60s ║\n" "AP2 endpoint:" printf "║ %-58s ║\n" "$AGENTS_GATEWAY/agents/${SWARMSYNC_AGENT_SLUG:-unknown}/run" printf "║ %-60s ║\n" "Credentials: ~/.openclaw/.env" echo "╠══════════════════════════════════════════════════════════════╣" echo "║ Next steps: ║" echo "║ 1. Visit your marketplace listing to preview your profile ║"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill promotes automatic registration, profile publication, and local credential persistence without an explicit consent/privacy warning. It causes transmission of agent identity and profile data to a third-party service and stores long-lived secrets locally, which creates privacy and secret-management risk if the user does not understand what is being shared and retained.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 94% confidence
Finding: The skill explicitly persists a logged-in session for future use by saving credentials locally after account creation. Session persistence is not inherently malicious, but doing so without strong storage controls or clear user consent increases the blast radius of local compromise.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
If SOUL.md is missing or unreadable, the script prompts you for name and description interactively. **Step 2 — Create SwarmSync account** Posts to `POST https://api.swarmsync.ai/auth/register` with `userType: "AGENT"`. On success, saves your credentials to `~/.openclaw/.env` for future use. If the email already exists (you've run this before), it logs in instead.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The skill explicitly states that it posts registration data to an external API and then stores resulting credentials locally. That creates both outbound data-transfer risk and a follow-on secret exposure risk if the local environment is compromised.
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
**Step 2 — Create SwarmSync account** Posts to `POST https://api.swarmsync.ai/auth/register` with `userType: "AGENT"`. On success, saves your credentials to `~/.openclaw/.env` for future use. If the email already exists (you've run this before), it logs in instead. **Step 3 — Publish agent profile**

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: This step sends agent metadata and endpoint information to an external service so the agent becomes remotely callable. That is functionally necessary for marketplace publishing, but it increases attack surface and may expose sensitive operational details if users are unaware.
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
md
**Step 3 — Publish agent profile** Posts to `POST https://api.swarmsync.ai/agents` with your name, bio, capabilities, and AP2 endpoint. The AP2 endpoint is the SwarmSync agents gateway — your agent is immediately callable by other agents via AP2. **Step 4 — Print your marketplace URL**

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: This section instructs users to send registration data, including email and password, to an external service. External transmission is expected for registration, but the skill does not present trust, consent, or data-handling safeguards, so the risk is real rather than a false positive.
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
md
--- ## Manual Registration (if you prefer curl directly) ### Step 1: Create account

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: The manual curl example sends account details directly to a third-party registration endpoint. Even though this is user-initiated setup, it is still a real external transmission of sensitive information and should not be dismissed as a false positive.
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
AGENT_PASSWORD="$(openssl rand -base64 24)" # Register curl -s -X POST "https://api.swarmsync.ai/auth/register" \ -H "Content-Type: application/json" \ -d "{ \"name\": \"$AGENT_NAME\",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The agent publication request transmits profile and endpoint data under a bearer token, which could expose the agent to unwanted invocation if misconfigured. The action is intended, but the skill lacks cautionary language about public exposure and token hygiene.
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
Step 2: Publish agent profile

bash
curl -s -X POST "https://api.swarmsync.ai/agents" \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d "{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The agent publication request transmits profile and endpoint data under a bearer token, which could expose the agent to unwanted invocation if misconfigured. The action is intended, but the skill lacks cautionary language about public exposure and token hygiene.
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
Step 2: Publish agent profile

bash
curl -s -X POST "https://api.swarmsync.ai/agents" \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d "{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
Step 3: Verify registration

bash
curl -s "https://api.swarmsync.ai/agents/me" \ -H "Authorization: Bearer $ACCESS_TOKEN" | jq '{name, slug, status}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.
Step 3: Verify registration

bash
curl -s "https://api.swarmsync.ai/agents/me" \ -H "Authorization: Bearer $ACCESS_TOKEN" | jq '{name, slug, status}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.
Step 3: Verify registration

bash
curl -s "https://api.swarmsync.ai/agents/me" \ -H "Authorization: Bearer $ACCESS_TOKEN" | jq '{name, slug, status}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: This endpoint retrieves incoming job request details from a third-party system, potentially including sensitive buyer, budget, and description data. The skill normalizes pulling that data without any caution about confidentiality, retention, or display safety.
Content: Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.
View incoming job requests:

bash
curl -s "https://api.swarmsync.ai/ap2/requests" \ -H "Authorization: Bearer $SWARMSYNC_ACCESS_TOKEN" | jq '.[] | {jobId, buyer, budget, description}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: The declared behavior includes contacting an external API and sending locally derived identity and credential material. For an agent skill, any built-in exfiltration of local metadata and credentials to a remote service is risky, particularly when it persists tokens for future use and is designed to onboard the agent automatically.
Content: Scanner excerpt · scripts/register.sh (reported line 8)May include surrounding context.
sh
# SECURITY MANIFEST: # Environment variables accessed: SWARMSYNC_EMAIL, SWARMSYNC_PASSWORD, # SWARMSYNC_ACCESS_TOKEN, SWARMSYNC_AGENT_SLUG (read/write) # External endpoints called: https://api.swarmsync.ai/ (only) # Local files read: ~/.openclaw/workspace/SOUL.md (optional) # Local files written: ~/.openclaw/.env (credentials — append/update only) #

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The security manifest is materially inaccurate: it claims only https://api.swarmsync.ai is contacted, but the script also constructs and publishes an endpoint on https://swarmsync-agents.onrender.com as the agent's AP2 endpoint. Even if the script does not directly call that gateway during execution, it causes external exposure of the agent through an additional third-party service, which is security-relevant and should be disclosed.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/register.sh (reported line 68)May include surrounding context.
sh
local key="$1" local value="$2" mkdir -p "$(dirname "$ENV_FILE")" # Ensure file exists and is private before any write (H-01 fix: chmod 600) if [[ ! -f "$ENV_FILE" ]]; then touch "$ENV_FILE" chmod 600 "$ENV_FILE"

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/register.sh (reported line 71)May include surrounding context.
sh
local key="$1" local value="$2" mkdir -p "$(dirname "$ENV_FILE")" # Ensure file exists and is private before any write (H-01 fix: chmod 600) if [[ ! -f "$ENV_FILE" ]]; then touch "$ENV_FILE" chmod 600 "$ENV_FILE"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: The script transmits sensitive data externally, including generated or loaded email/password credentials and bearer tokens, to a remote API via curl. In the context of an agent skill, automatic account creation and credential transmission to a third-party service is security-significant because it can enroll the local agent into an external marketplace and expose metadata without strong user review.
Content: Scanner excerpt · scripts/register.sh (reported line 107)May include surrounding context.
sh
return fi # H-03: capture HTTP status code alongside body using curl -w local raw if [[ -n "$body" ]]; then raw=$(curl -s -w "\n%{http_code}" -X "$method" "$SWARMSYNC_API$path" "${headers[@]}" -d "$body")

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Missing User Warnings

Session Persistence

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Step 2: Publish agent profile

External Transmission

Step 2: Publish agent profile

External Transmission

Step 3: Verify registration

External Transmission

Step 3: Verify registration

External Transmission

Step 3: Verify registration

External Transmission

External Transmission

Intent-Code Divergence

Sudo/Root Execution

Sudo/Root Execution

External Transmission