Security audit

Swarm

Security checks across malware telemetry and agentic risk

Overview

Swarm appears to be a legitimate parallel LLM worker tool, but it needs Review because it stores API keys locally and exposes an unauthenticated HTTP service that can send prompts and web requests through the user's accounts.

Install only if you are comfortable with a local daemon that can spend/use your LLM API keys, send prompts and fetched content to external providers, and persist keys, cache entries, and metrics under your home directory. Keep the daemon bound to trusted local use, avoid submitting secrets or regulated data, disable web search/cache for sensitive work where possible, and do not run benchmark or Supabase scripts against production credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (44)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises and documents capabilities that imply shell execution, environment access, and network use, but it declares no permissions. This creates a transparency and consent problem: an agent or user may invoke a skill with materially broader powers than expected, increasing the risk of unintended command execution, secret access, or outbound data transfer.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description frames the skill as a simple cost-saving LLM offloading tool, but the documented behavior is much broader: it runs a daemon, exposes local HTTP endpoints, persists data, performs web retrieval, and supports orchestration features. That mismatch is dangerous because users and upstream policy systems may trust the narrow description and underestimate the skill's attack surface, data handling, and execution privileges.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The script automatically reads an API key from a fixed file path in the user's home directory if the environment variable is absent. Accessing local credential material without explicit user consent broadens the skill's authority and can unintentionally use or expose secrets the user did not expect this script to touch.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The setup script persists the user's API key to a plaintext local file and also saves a machine profile containing system and recommendation data. Although local storage is sometimes legitimate, this exceeds the narrow cost-offloading description and creates credential and host-information exposure if the local account, backups, or dotfiles are accessed by other software or users.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The script enables optional live web search capability for Gemini workers even though the manifest description only mentions offloading parallel and research work. Undisclosed network-enabled features expand data exposure and behavior beyond user expectations, especially if research prompts or sensitive context are sent to web-grounded queries.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The installer banner, comments, and usage text identify this as a 'swarm' skill, but the script actually references and installs a different 'node-scaling' Clawdbot project. That mismatch is dangerous because users may grant trust and execute the installer under false assumptions, enabling software substitution or deceptive installation of an unintended component.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The script's operational behavior clones, updates, configures, and runs setup for 'node-scaling' under a Clawdbot-specific directory rather than installing the advertised swarm skill. In a skill distribution context, this is effectively a deceptive installer: it can cause users to deploy unrelated code and execute its setup logic, increasing the risk of unauthorized changes and unexpected code execution.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The auto chain builder can silently enable `webSearch: true` via the `enrich` stage based solely on natural-language task matching, which expands the skill from simple model offloading into external data retrieval. This creates a capability/expectation mismatch: user or upstream code may invoke the builder assuming only local/worker processing, while task text can trigger network-backed research with privacy, compliance, and prompt-injection exposure.

Context-Inappropriate Capability

Low

Confidence: 87% confidence
Finding: The daemon exposes cache statistics and allows unauthenticated cache clearing over HTTP, while also exposing internal metrics elsewhere, and the server sets permissive CORS headers for all origins. In a local service context this can enable any local user or a malicious webpage targeting localhost to probe operational state or disrupt service behavior by clearing shared cache contents, creating an information disclosure and integrity issue.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The diagnostics code enumerates API credentials from both environment variables and local key files, expanding access to sensitive secrets beyond what is necessary for a simple health check. Even though it does not exfiltrate them in this file, secret discovery increases the blast radius of the module and normalizes credential handling in a component whose purpose is diagnostics.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The module spawns local Node.js processes to execute test files, which gives the skill an execution capability outside the narrow manifest description of offloading LLM work. If test files are modified, malicious, or unexpectedly present, invoking diagnostics could execute arbitrary local code under the user's privileges.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The script ingests sensitive profile data from environment variables and reads an API key from a local file, then later includes the profile context in prompts and persisted output. This creates unnecessary exposure of personal and credential-adjacent data for a utility whose stated purpose is cost-efficient task offloading, increasing the risk of privacy leakage if logs, outputs, or downstream services are compromised.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The code fetches and processes arbitrary URLs from a local input file, effectively acting as a crawler/HTTP client beyond the narrow manifest description. This can be abused for unintended network access such as contacting internal services, metadata endpoints, or sensitive intranet resources if an attacker controls the URL list.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The script writes a persistent results file containing user context, full analysis outputs, and derived questions to a predictable local path. Persisting this data broadens exposure because anyone with access to that filesystem location may recover sensitive profile details and analyzed content long after execution.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README explicitly documents live web search and local HTTP endpoints that forward user prompts to external model providers, but it does not clearly warn users that prompt contents may leave the local machine and be transmitted to third-party services. In an agent skill context, users may pass sensitive business data, credentials, or internal research into these endpoints, so the lack of an explicit privacy/data-handling warning can lead to unintended disclosure.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill documents live web search and external API usage but does not warn that prompts, subjects, topics, and possibly fetched content will be transmitted to third-party services. In a skill designed for research and batch processing, this omission can lead to accidental disclosure of sensitive user data, proprietary text, or internal URLs to external providers.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documented persistent prompt cache stores model interaction material to disk across daemon restarts without warning users that their prompts and derived task context may remain locally persisted. Because this skill is built for batch, research, and analysis workloads, cached entries may contain sensitive business data, URLs, or personal information that could be exposed to other local users, backups, or later compromise.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script forwards fetched webpage content to Google's Gemini service for analysis without any disclosure, confirmation, or filtering step. In a broader use case, this pattern can transmit third-party or potentially sensitive content to an external provider, creating privacy, compliance, and data-handling risks.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The benchmark script performs a destructive delete against the Supabase `swarm_blackboard` table whenever `SUPABASE_URL` and `SUPABASE_SERVICE_KEY` are present, with no warning, confirmation, dry-run mode, or environment guard. Because it uses a service key, the operation likely bypasses row-level protections, so a user running the benchmark against a shared or production Supabase project could unintentionally delete matching data.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The benchmark includes an autonomous research test that explicitly enables Supabase-backed research and therefore triggers external API/network activity without any upfront user notice or confirmation. In a benchmarking script, users may run all tests by default and unintentionally transmit prompts or research subjects to third-party services, creating privacy, cost, and compliance risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script writes the API key to a local file without clearly warning the user beforehand that the secret will be persisted on disk. Even with restrictive file permissions, plaintext local secret storage increases the risk of compromise through malware, backups, accidental disclosure, or multi-user access patterns.

Missing User Warnings

Low

Confidence: 75% confidence
Finding: The setup injects the provided API key into process.env and then runs diagnostics without first disclosing that follow-on code will receive the credential. This broadens secret exposure to any diagnostic subcomponents, logs, crashes, or future code changes that may read or emit environment variables.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The `--context` flag explicitly enables pre-fetching BrainDB memories and injecting them into worker prompts, but the CLI only advertises convenience and does not warn that potentially sensitive stored context may be transmitted onward during task execution. In a tool designed to offload work to LLM workers, this increases the risk of unintentional disclosure of private or proprietary memory contents to downstream services.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The roadmap proposes auto-activating Swarm based on broad natural-language triggers like 'compare', 'each of these', and 'all of'. In an agent skill, this can cause unintended delegation of user content to multiple external workers/models, increasing the chance of accidental data exposure, higher-cost fanout, and execution of parallel subtasks the user did not explicitly authorize.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The benchmark sends user-supplied task and data directly to an external Gemini client for evaluation without any visible consent, warning, or minimization step in this file. If users provide sensitive or regulated data, benchmarking causes that content to leave the local trust boundary and be processed by a third-party model service, creating confidentiality and compliance risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration (+1 more)

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: lib/diagnostics.js:194

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test/run-all.js:22

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: bench.js:8

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: docker/worker/agent.js:14

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: tap-analysis.js:14

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: bench.js:9

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: tap-analysis.js:49

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: CHANGELOG.md:122