T03 · Remote Payload Retrieval and Execution
Error
- Location
install.sh:6- Finding
Mutable Remote Installer Is Recommended for Direct Shell Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Swarm
Security checks for vulnerabilities and agentic risk
Overview
Swarm is a coherent LLM parallel-processing skill, but its install path and unauthenticated local daemon create real risk around paid API use and cached responses.
Install only if you trust the publisher and can run it in a controlled local environment. Avoid curl-to-bash installation, inspect or pin the source first, keep provider-side spending limits enabled, do not expose port 9999 to other machines or browsers you do not trust, and avoid sending sensitive prompts unless caching is disabled or the cache directory is properly protected.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
lib/daemon.js:1347- Finding
Unauthenticated LLM Daemon Is Exposed Beyond the Localhost Boundary
- Content
View full analysis
this.handleRequest(req, res)); this.server.listen(this.port, () => { console.log(`🚀 Swarm Daemon ready on http://localhost:${this.port}`); ``` ### Technical Analysis Calling `server.listen(port)` without a hostname normally binds the Node.js server to an unspecified address, making it available through network interfaces rather than restricting it to `127.0.0.1`. The log message claims that the daemon is available on localhost, but it does not enforce that boundary. No authentication or authorization check is performed before dispatching `/parallel`, `/research`, `/chain`, `/vote`, `/benchmark`, or other task endpoints. These operations use API credentials configured by the daemon owner. The wildcard `Access-Control-Allow-Origin` policy additi ...[truncated 1535 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
lib/daemon.js:1291- Finding
Unbounded HTTP Request Body Enables Memory Exhaustion
- Content
View full analysis
{ let body = ''; req.on('data', chunk => body += chunk); req.on('end', () => resolve(body)); req.on('error', reject); }); } ``` ### Technical Analysis The body parser concatenates every received chunk into an in-memory JavaScript string. It does not track the number of received bytes or impose an endpoint-specific maximum. The parser also lacks a body-read timeout, content-type validation, and early connection destruction. An attacker can therefore send a very large request or slowly stream data while retaining server resources. This issue is especially exploitable because the daemon does not authenticate callers and may listen on non-loopback interfaces. ### Attack Path 1. The attacker establishes one or more connections to a POST endpoint that calls `readBody`. 2. The attacker streams a very large body or continuously sends chunks without completing the request. 3. Each chunk is appended to the `body` string. 4. The Node.js process consumes increasing heap memory and connection resources. 5. The daemon slows down, terminates due to out-of-memory conditions, or becomes unavailable to legitimate clients. ### Impact Assessment The attacker can cause denial of service against the Swarm daemon. Depending on deployment and process supervision, memory pressure can also affect other workloads running in the same container or user session. No elevated operating-system privileges are obtained, but the availability of the LLM orchestration service and its active tasks can be disrupted. ]]>- Remediation
View remediation
{ size += chunk.length; if (size > MAX_BODY_BYTES) { req.destroy(); reject(new Error('Request body too large')); return; } body += chunk; }); ``` 2. Return HTTP 413 for oversized requests. 3. Configure server header, request, and keep-alive timeouts. 4. Validate `Content-Type: application/json` before reading JSON bodies. 5. Apply lower limits to simple endpoints and explicitly justified higher limits to document-processing endpoints. 6. Add authenticated per-client rate and concurrency limits. 7. Test oversized bodies and slow-stream behavior in integration tests. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
config.js:89- Finding
Advertised Daily Spending Limits Are Not Enforced
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
lib/cache.js:35- Finding
Plaintext Prompt Cache Can Leak Responses and Return Cross-Input Results
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (122)
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md view` — Dry-run to see pipeline plan without executing - 7 task pattern detectors (comparative, research-deep, adversarial, filter-refine, multi-perspective, opportunity, summarize) - 4 depth presets: quick (2 stages), standard (4), deep (5-6), exhaustive (8) - Smart perspective selection based on task keywords - **Capabilities discovery** — `GET /capabilities` endpoint for orchestrator LLMs - Lists all execution modes, perspectives, transforms, and depth presets - `swarm capabilities` CLI command - **Benchmark** — Quality comparison tool (single vs parallel vs chain) - `POST /benchmark` — Runs same task through all 3 modes - LLM-as-judge scoring on 6 dimensions (accuracy, depth, completeness, coherence, actionability, nuance) - Cost/quality ratio comparison table - Based on G-Eval/FLASK evaluation methodology - **Worker perspective override** — Chain stages inject custom system prompts per worker ### Changed - Client library: added `chain()`, `chainSync()`
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 80% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
md ### Security - Workers now refuse to output API keys, tokens, or credentials - External content treated as DATA, not instructions - Injection attempts like "ignore all previous instructions" are logged and ignored - Credentials patterns (Google, OpenAI, Anthropic, GitHub, Slack) auto-redacted from output ## [0.2.0] - 2026-01-25
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ### 1. Make your code changes Edit files in `~/clawd/skills/node-scaling/` ### 2. Update SKILL.md Update the root `SKILL.md` with any new features, endpoints, or config changes. This is what the agent reads. ### 3. Bump version
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
5. Stage the publish directory
bash # Clean slate rm -rf /tmp/swarm-publish mkdir -p /tmp/swarm-publish/references # Copy docs only
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
5. Stage the publish directory
bash # Clean slate rm -rf /tmp/swarm-publish mkdir -p /tmp/swarm-publish/references # Copy docs only
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.
- Content