Swarm

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:51 AM UTC
• Version: 1.3.7

Overview

Swarm is a coherent LLM parallel-processing skill, but its install path and unauthenticated local daemon create real risk around paid API use and cached responses.

Install only if you trust the publisher and can run it in a controlled local environment. Avoid curl-to-bash installation, inspect or pin the source first, keep provider-side spending limits enabled, do not expose port 9999 to other machines or browsers you do not trust, and avoid sending sensitive prompts unless caching is disabled or the cache directory is properly protected.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: install.sh:6
• Finding: Mutable Remote Installer Is Recommended for Direct Shell Execution<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:6` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash # Usage: curl -fsSL https://raw.githubusercontent.com/clawdbot/node-scaling/main/install.sh | bash ``` Related repository retrieval in `install.sh:50-55`: ```bash else echo "Cloning repository..." mkdir -p "$CLAWDBOT_HOME/skills" git clone --quiet https://github.com/Chair4ce/node-scaling.git "$SKILL_DIR" echo -e "${GREEN}✓ Cloned${NC}" fi ``` ### Technical Analysis The installer explicitly recommends downloading a mutable script from a remote GitHub branch and piping it directly into Bash. Although the command appears in a usage comment, it is an executable installation instruction intended for users to copy and run. The downloaded content is not pinned to an immutable commit or release. There is no checksum, digital signature, or review step before execution. Consequently, the effective installer payload can change after the Skill has been audited. There is also a provenance inconsistency: the pipe-to-shell URL references `clawdbot/node-scaling`, while the installer clones `Chair4ce/node-scaling`. The project metadata and documentation similarly use different repository identities. This makes it harder for users to determine which publisher and repository are authoritative. ### Attack Path 1. A user follows the documented `curl ... | bash` installation instruction. 2. Before installation, an attacker compromises the referenced GitHub account, repository, branch, maintainer credentials, or publication process. 3. The attacker modifies the remote `install.sh` on the mutable `main` branch. 4. `curl` downloads the modified content. 5. Bash executes the content immediately, without displaying it or verifying its integrity. 6. The payload runs with all privileges available to the installing user and can access that user's files, credentials, environment, and ...[truncated 450 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | bash` installation recommendation. 2. Publish immutable, versioned release archives rather than installing from a mutable branch. 3. Provide SHA-256 checksums and preferably signed release artifacts. 4. Instruct users to download the release, verify its signature or checksum, inspect the installer, and execute it as a separate step. 5. Pin automated installation to a release tag and immutable commit digest. 6. Reconcile the `clawdbot/node-scaling` and `Chair4ce/node-scaling` repository references and clearly identify the authoritative publisher. 7. Avoid running dependency installation from an unverified checkout. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: lib/daemon.js:1347
• Finding: Unauthenticated LLM Daemon Is Exposed Beyond the Localhost Boundary<![CDATA[ ## Vulnerability Details **File Location**: `lib/daemon.js:99-111`, `lib/daemon.js:119-259`, and `lib/daemon.js:1347-1350` **Vulnerability Type**: Missing authentication, permissive CORS, and unsafe network binding **Risk Level**: High ### Vulnerable Code CORS is granted to every origin: ```js async handleRequest(req, res) { const url = new URL(req.url, `http://localhost:${this.port}`); // CORS headers for local use res.setHeader('Access-Control-Allow-Origin', '*'); res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS'); res.setHeader('Access-Control-Allow-Headers', 'Content-Type'); if (req.method === 'OPTIONS') { res.writeHead(204); res.end(); return; } ``` Sensitive, paid operations are routed without an authentication or authorization check: ```js // Parallel execution if (url.pathname === '/parallel' && req.method === 'POST') { await this.handleParallel(req, res); return; } // Research (multi-phase) if (url.pathname === '/research' && req.method === 'POST') { await this.handleResearch(req, res); return; } ``` The server is started without specifying a loopback address: ```js // Start HTTP server this.server = http.createServer((req, res) => this.handleRequest(req, res)); this.server.listen(this.port, () => { console.log(`🚀 Swarm Daemon ready on http://localhost:${this.port}`); ``` ### Technical Analysis Calling `server.listen(port)` without a hostname normally binds the Node.js server to an unspecified address, making it available through network interfaces rather than restricting it to `127.0.0.1`. The log message claims that the daemon is available on localhost, but it does not enforce that boundary. No authentication or authorization check is performed before dispatching `/parallel`, `/research`, `/chain`, `/vote`, `/benchmark`, or other task endpoints. These operations use API credentials configured by the daemon owner. The wildcard `Access-Control-Allow-Origin` policy additi ...[truncated 1535 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bind explicitly to `127.0.0.1` and, where needed, `::1`: ```js this.server.listen(this.port, '127.0.0.1', callback); ``` 2. Require a cryptographically random bearer token for every non-health endpoint. 3. Store the token in a user-only file with mode `0600`. 4. Replace wildcard CORS with an allowlist, or disable CORS entirely for a CLI-only local API. 5. Validate `Origin` and reject browser requests from untrusted origins. 6. Keep remote network access disabled by default. If remote operation is required, make it an explicit opt-in with TLS and strong authentication. 7. Add per-client request and concurrency limits. 8. Ensure firewall and container configuration does not publish the daemon port unintentionally. 9. Update log output and documentation so they accurately describe the enforced bind address. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: lib/daemon.js:1291
• Finding: Unbounded HTTP Request Body Enables Memory Exhaustion<![CDATA[ ## Vulnerability Details **File Location**: `lib/daemon.js:1291-1297` **Vulnerability Type**: Unbounded request-body accumulation **Risk Level**: High ### Vulnerable Code ```js /** * Helper to read request body */ readBody(req) { return new Promise((resolve, reject) => { let body = ''; req.on('data', chunk => body += chunk); req.on('end', () => resolve(body)); req.on('error', reject); }); } ``` ### Technical Analysis The body parser concatenates every received chunk into an in-memory JavaScript string. It does not track the number of received bytes or impose an endpoint-specific maximum. The parser also lacks a body-read timeout, content-type validation, and early connection destruction. An attacker can therefore send a very large request or slowly stream data while retaining server resources. This issue is especially exploitable because the daemon does not authenticate callers and may listen on non-loopback interfaces. ### Attack Path 1. The attacker establishes one or more connections to a POST endpoint that calls `readBody`. 2. The attacker streams a very large body or continuously sends chunks without completing the request. 3. Each chunk is appended to the `body` string. 4. The Node.js process consumes increasing heap memory and connection resources. 5. The daemon slows down, terminates due to out-of-memory conditions, or becomes unavailable to legitimate clients. ### Impact Assessment The attacker can cause denial of service against the Swarm daemon. Depending on deployment and process supervision, memory pressure can also affect other workloads running in the same container or user session. No elevated operating-system privileges are obtained, but the availability of the LLM orchestration service and its active tasks can be disrupted. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Track received bytes and enforce a conservative maximum: ```js const MAX_BODY_BYTES = 1024 * 1024; let size = 0; req.on('data', chunk => { size += chunk.length; if (size > MAX_BODY_BYTES) { req.destroy(); reject(new Error('Request body too large')); return; } body += chunk; }); ``` 2. Return HTTP 413 for oversized requests. 3. Configure server header, request, and keep-alive timeouts. 4. Validate `Content-Type: application/json` before reading JSON bodies. 5. Apply lower limits to simple endpoints and explicitly justified higher limits to document-processing endpoints. 6. Add authenticated per-client rate and concurrency limits. 7. Test oversized bodies and slow-stream behavior in integration tests. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: config.js:89
• Finding: Advertised Daily Spending Limits Are Not Enforced<![CDATA[ ## Vulnerability Details **File Location**: `config.js:89-90` and `bin/setup.js:136-140` **Vulnerability Type**: Ineffective cost-control security boundary **Risk Level**: High ### Vulnerable Code The configuration parser accepts daily spending controls: ```js maxDailySpend: userConfig?.node_scaling?.cost?.max_daily_spend || 5.00, warnAt: userConfig?.node_scaling?.cost?.warn_at || 1.00, ``` The setup wizard writes the controls to the generated configuration: ```yaml # Cost controls (optional) cost: max_daily_spend: 5.00 warn_at: 1.00 ``` Cost handling in the daemon reports and persists accumulated cost, but the reviewed request execution paths do not compare new work against `maxDailySpend` before scheduling provider requests. The repository search found no request refusal based on `config.cost`, `maxDailySpend`, or `warnAt`. ### Technical Analysis A hard spending cap is a security control only if it is checked before paid work is accepted. In this implementation, the configured values create the appearance of protection but are not connected to request admission. The daemon calculates and reports costs after provider activity. The separate request rate limiter defaults its daily request limit to zero, which means unlimited requests, and it does not enforce a monetary cap. Because the daemon is also unauthenticated, this missing enforcement materially increases the impact of unauthorized API use. ### Attack Path 1. The victim configures `max_daily_spend` and assumes that provider charges will stop at that amount. 2. The daemon accepts task requests and dispatches them to the configured provider. 3. A local process, network caller, or malicious website repeatedly invokes paid endpoints. 4. Reported daily cost crosses the configured threshold. 5. Since no pre-request cap check rejects additional work, provider calls continue and charges accumulate. ### Impact Assessment Attackers or malfunctioning clients can consume substantially more ...[truncated 331 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enforce the limit before any provider work is scheduled. 2. Atomically read persisted daily spending and reserve the estimated cost of an accepted request. 3. Reject requests that would exceed the hard cap with an appropriate HTTP error. 4. Treat `warn_at` as an alert threshold and `max_daily_spend` as a mandatory refusal threshold. 5. Reconcile reservations with actual token cost after completion. 6. Include all retries, parallel workers, voting candidates, benchmark judges, reflection calls, and warm-up calls in cost accounting. 7. Make updates safe against concurrent requests and daemon restarts. 8. Add a configurable maximum number of tasks per request and a nonzero daily request limit. 9. Add tests proving that requests are rejected once the cap is reached and remain rejected after a daemon restart. 10. Document that provider-side account budgets remain an additional required safeguard. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: lib/cache.js:35
• Finding: Plaintext Prompt Cache Can Leak Responses and Return Cross-Input Results<![CDATA[ ## Vulnerability Details **File Location**: `lib/cache.js:35-43`, `lib/cache.js:73-91`, and `lib/cache.js:137-154` **Vulnerability Type**: Insecure sensitive-data persistence and incomplete cache-key construction **Risk Level**: Medium ### Vulnerable Code Only the first 2,000 characters of the input are included in the cache key: ```js key(instruction, input, perspective) { const raw = JSON.stringify({ i: (instruction || '').trim(), d: (input || '').trim().substring(0, 2000), // Only hash first 2K of input for key p: (perspective || '').trim(), }); return crypto.createHash('sha256').update(raw).digest('hex').substring(0, 16); } ``` Full model responses are retained: ```js this.entries.set(k, { response, createdAt: Date.now(), expiresAt: Date.now() + ttl, hits: 0, instruction: instruction?.substring(0, 80), }); ``` They are persisted without an explicit restrictive file mode: ```js persist() { try { if (!fs.existsSync(CACHE_DIR)) { fs.mkdirSync(CACHE_DIR, { recursive: true }); } // Only persist non-expired entries const now = Date.now(); const data = {}; for (const [k, entry] of this.entries) { if (now < entry.expiresAt) { data[k] = entry; } } fs.writeFileSync(CACHE_FILE, JSON.stringify(data)); this.stats.persisted = Object.keys(data).length; } catch (e) { // Non-critical } } ``` ### Technical Analysis The cache key omits all input characters after position 2,000. Two requests with the same instruction, perspective, and first 2,000 input characters therefore produce the same key even when their remaining content differs. A later request can receive a response generated for a different document or context. The key is also truncated to 16 hexadecimal characters, reducing it to 64 bits. Although prefix-equivalent inputs are the more practical issue, truncation unnecessarily increases collision risk. Full responses are written to `~/.con ...[truncated 1504 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Hash the complete normalized input rather than truncating it. 2. Retain the full SHA-256 digest instead of truncating it to 64 bits. 3. Include every response-affecting field in the key, including provider, model, system prompt, temperature, tools, schema, web-search state, and relevant options. 4. Include a user, tenant, or session namespace when multiple callers can access the daemon. 5. Create the cache directory with mode `0700` and cache file with mode `0600`. 6. Write through a securely created temporary file and atomically rename it. 7. Disable caching by default for potentially sensitive document-processing requests. 8. Provide explicit sensitivity and no-store controls. 9. Remove expired entries from the persisted file promptly rather than only excluding them on a later persistence cycle. 10. Consider authenticated encryption if cache contents must survive restarts on shared systems. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (122)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

view` — Dry-run to see pipeline plan without executing
  - 7 task pattern detectors (comparative, research-deep, adversarial, filter-refine, multi-perspective, opportunity, summarize)
  - 4 depth presets: quick (2 stages), standard (4), deep (5-6), exhaustive (8)
  - Smart perspective selection based on task keywords
- **Capabilities discovery** — `GET /capabilities` endpoint for orchestrator LLMs
  - Lists all execution modes, perspectives, transforms, and depth presets
  - `swarm capabilities` CLI command
- **Benchmark** — Quality comparison tool (single vs parallel vs chain)
  - `POST /benchmark` — Runs same task through all 3 modes
  - LLM-as-judge scoring on 6 dimensions (accuracy, depth, completeness, coherence, actionability, nuance)
  - Cost/quality ratio comparison table
  - Based on G-Eval/FLASK evaluation methodology
- **Worker perspective override** — Chain stages inject custom system prompts per worker

### Changed
- Client library: added `chain()`, `chainSync()`

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Instruction Override

High

• Category: Prompt Injection

Content

### Security
- Workers now refuse to output API keys, tokens, or credentials
- External content treated as DATA, not instructions
- Injection attempts like "ignore all previous instructions" are logged and ignored
- Credentials patterns (Google, OpenAI, Anthropic, GitHub, Slack) auto-redacted from output

## [0.2.0] - 2026-01-25

• Confidence: 80% confidence
• Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Self-Modification

High

• Category: Rogue Agent

Content

### 1. Make your code changes
Edit files in `~/clawd/skills/node-scaling/`

### 2. Update SKILL.md
Update the root `SKILL.md` with any new features, endpoints, or config changes. This is what the agent reads.

### 3. Bump version

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 5. Stage the publish directory
```bash
# Clean slate
rm -rf /tmp/swarm-publish
mkdir -p /tmp/swarm-publish/references

# Copy docs only

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### 5. Stage the publish directory
```bash
# Clean slate
rm -rf /tmp/swarm-publish
mkdir -p /tmp/swarm-publish/references

# Copy docs only

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill documentation includes live web research and implies fetching/analyzing multiple URLs, but the top-level metadata does not clearly declare these outbound data access behaviors. This matters because users may provide confidential prompts or URLs assuming local orchestration, while the skill can transmit those inputs to network services and retrieve remote content.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration (+1 more)

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: lib/diagnostics.js:194

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: test/run-all.js:22

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: bench.js:8

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: docker/worker/agent.js:14

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: tap-analysis.js:14

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: bench.js:9

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: tap-analysis.js:49

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: CHANGELOG.md:122