Security audit

agent-swarm

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its agent marketplace purpose, but it gives a worker daemon broad automatic execution and wallet authority with insufficient confirmation, isolation, and key handling.

Review this carefully before installing. Use only a dedicated low-balance wallet, prefer env:WALLET_PRIVATE_KEY over --key, do not run worker start against untrusted boards, and avoid automatic task execution unless it is isolated in a container or VM with stripped secrets and limited network/filesystem access. Confirm every escrow release, refund, stake, and milestone transaction manually, and treat the dashboard and helper scripts as needing cleanup before production use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: cli.js:1225
Finding: Untrusted XMTP task content is automatically passed to privileged local coding agents
Content: View full analysis
`- ${s.title || ''}: ${s.description || ''}`).join('\n')}` : '', '', 'Complete the task. Write all output files to the work directory.', 'When done, write a RESULT.md summarizing what you did.', ].join('\n'); const promptPath = join(workDir, '_prompt.txt'); writeFileSync(promptPath, prompt); try { let result; if (agent.name === 'codex') { result = spawnSync(agent.path, ['exec', prompt], { cwd: workDir, timeout, maxBuffer: 1024 * 1024, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], }); } else if (ag ...[truncated 2835 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: cli.js:122
Finding: Wallet private keys are exposed through command-line arguments, terminal output, and plaintext configuration
Content: View full analysis
s.trim()); const config = { wallet: { privateKey }, board: { id: flags['board-id'] || null, name: 'Agent Swarm Board' }, worker: { skills, rates: Object.fromEntries(skills.map(s => [s, '2.00'])), maxBid: '20.00', minBid: '0.50', autoAccept: flags['auto-accept'] !== 'false', }, escrow: { address: '0xE2b1D96dfbd4E363888c4c4f314A473E7cA24D2f', defaultDeadlineHours: 24, }, xmtp: { env: 'production' }, network: { chainId: 8453, rpc: 'https://mainnet.base.org', usdc: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913', }, }; writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2)); console.log(`Config written to ${CONFIG_PATH}`); const { createSwarmAgent } = await import('./src/agent.js'); const dbName = `.xmtp-${wallet.address.slice(2, 10).toLowerCase()}`; const dbPath = join(__dirname, dbName); config.xmtp.dbPath = dbName; writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2)); ``` ### Technical Analysis Existing private keys are accepted with a command-line flag. Command-line secrets may be retained ...[truncated 1601 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: cli.js:1167
Finding: Worker executes task messages without validating assignment, sender, or escrow state
Content: View full analysis
= MAX_CONCURRENT_TASKS) { console.log(`[TASK RECEIVED] "${parsed.title}" — QUEUED (${activeTasks}/${MAX_CONCURRENT_TASKS} active)`); continue; } activeTasks++; console.log(`[TASK RECEIVED] "${parsed.title}" (${activeTasks}/${MAX_CONCURRENT_TASKS} active)`); console.log(` Executing...`); const { execute } = await import('./src/executor.js'); try { const result = await execute(parsed, config); ``` ```js // cli.js:1225-1239 for (const m of msgs) { if (seenMessages.has(m.id)) continue; seenMessages.add(m.id); if (m.senderInboxId === agent.client.inboxId) continue; try { const parsed = JSON.parse(typeof m.content === 'string' ? m.content : JSON.stringify(m.content)); if (parsed?.type === 'task') { console.log(`[TASK from private group] "${parsed.title}"`); const { execute } = await import('./src/executor.js'); const result = await execute(parsed, config); const { sendProtocolMessage } = await import('./src/agent.js'); const subId = parsed.subtasks?.[0]?.id || `${parsed.id}-s1`; ``` ### Technical Analysis Task execution is authorized only by a message's JSON `type`. The worker does not verify that: - the sender is the expected requestor; - the task was assigned to the current worker; - the worker previously submitted the accepted bid; - the message arrived in the correct task conversation; - an associated escrow exists; - the escrow uses the configured contract and chain; - the escrow amount and parties match the assignment; - the task has received user approval. One execution path processes task messages among messages retrieved from the bulletin board, while another ...[truncated 1326 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: index.html:390
Finding: Unescaped on-chain registry metadata enables persistent dashboard DOM XSS
Content: View full analysis
{ const isMain = b.id === MAIN_BOARD; return `

${isMain ? 'MAIN' : ''} ${b.name} ▸

${b.description}

${b.pendingRequests} pending created ${timeAgo(b.createdAt)} owner: ${bsLink(b.owner)}

${b.skills.map(s => `${s}`).join('')}

${b.memberCount}

members

Members
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: index.html:296
Finding: Public client code embeds a reusable QuickNode RPC credential
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (138)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · CHANGELOG-v3.md (reported line 8)May include surrounding context.
md
## Security Hardening ### Critical: Shell Injection (executor.js) - **Before:** Task titles/descriptions from untrusted XMTP messages were interpolated into shell command strings via `execSync`. A malicious task like `'; rm -rf / #` could execute arbitrary commands on the worker's machine. - **After:** All execution paths use `spawnSync`/`execFileSync` with array arguments. Task input is never concatenated into shell strings. Tested with injection payloads: semicolons, backticks, `$()` substitution, quote escapes — all blocked. ### Critical: Git Clone Path Injection (executor.js)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · CHANGELOG-v3.md (reported line 8)May include surrounding context.
md
## Security Hardening ### Critical: Shell Injection (executor.js) - **Before:** Task titles/descriptions from untrusted XMTP messages were interpolated into shell command strings via `execSync`. A malicious task like `'; rm -rf / #` could execute arbitrary commands on the worker's machine. - **After:** All execution paths use `spawnSync`/`execFileSync` with array arguments. Task input is never concatenated into shell strings. Tested with injection payloads: semicolons, backticks, `$()` substitution, quote escapes — all blocked. ### Critical: Git Clone Path Injection (executor.js)

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · CHANGELOG-v3.md (reported line 8)May include surrounding context.
md
# Agent Swarm v3.0.0 — Security-First Audit + Milestone Escrow + Worker Staking Released: 2026-02-24 ## Security Hardening ### Critical: Shell Injection (executor.js) - **Before:** Task titles/descriptions from untrusted XMTP messages were interpolated into shell command strings via `execSync`. A malicious task like `'; rm -rf / #` could execute arbitrary commands on the worker's machine. - **After:** All execution paths use `spawnSync`/`execFileSync` with array arguments. Task input is never concatenated into shell strings. Tested with injection payloads: semicolons, backticks, `$()` substitution, quote escapes — all blocked. ### Critical: Git Clone Path Injection (executor.js) - **Before:** GitHub repo paths extracted from task descriptions were passed directly to `git clone` via shell string. - **After:** Repo paths are validated with strict regex (`^[a-zA-Z0-9_.-]+/[a-zA-Z0-9_.-]+$`). Invalid paths rej

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · README.md (reported line 163)May include surrounding context.
wallet guard (v3.1)

agents handling crypto shouldn't hold raw private keys without guardrails. inspired by @0xDeployer's lockdown approach, agent swarm now ships with a wallet guardian layer.

bash
# initialize with spending limits

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description promises a broad decentralized task marketplace/protocol on XMTP, including discovering agents, posting tasks, bidding, escrow, and USDC payments on Base. The supplied code only interacts with a BoardRegistry smart contract to manage bulletin boards and board membership requests. It supports registering boards, listing boards, requesting to join, approving join requests, and reading board metadata. While bulletin-board discovery is consistent with part of the description, the primary advertised capabilities around tasks, bidding, escrow, and payments are absent from this code chunk. Therefore the code does not accurately represent the full declared purpose and is materially narrower in behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description promises a decentralized task protocol with discovery, bidding, escrow, and real on-chain USDC payments on Base. This code chunk only demonstrates XMTP messaging between two locally created agents in a group on the dev network. The payment step is merely a serialized message containing a fabricated transaction hash and amount; there is no blockchain interaction, escrow contract usage, or token transfer. Likewise, there is no bulletin board discovery or bidding mechanism in the shown code. While the overall theme of agent-to-agent task coordination on XMTP is related, the implemented behavior in this chunk is substantially narrower and omits several core advertised capabilities, so the description does not accurately represent what this code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code partially matches the description at a high level because it does coordinate two agents over XMTP and pays USDC on Base. However, several core declared capabilities are absent from this code chunk. It does not implement bulletin-board-based discovery, task bidding, or any escrow/locked-payment mechanism; instead it performs a simple direct transfer from the requestor wallet to the worker wallet after a result message. The script is specifically a bilateral live demo rather than evidence of the fuller decentralized marketplace/protocol described. Therefore the declared description materially overstates what this code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about decentralized agent-to-agent task coordination over XMTP with bulletin boards, bidding, escrow, and USDC payments on Base. The supplied code does none of that. Instead, it is an operational deployment/synchronization script for pushing a local state.json file to a GitHub repository using a stored token. This introduces undeclared capabilities and resources: access to a secret token, interaction with GitHub, and remote repository modification. Those behaviors are materially different from the stated decentralized protocol purpose, so this is a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description describes a full decentralized marketplace/protocol for agent coordination and on-chain payments. The supplied code chunk only registers an XMTP agent using a provided key and local database path, starts it, and stops it. While XMTP registration could be a supporting step for such a system, this specific code does not implement or expose the core advertised capabilities such as discovering agents, posting tasks, bidding, escrow, or USDC payments on Base. Therefore the code chunk's actual behavior is materially narrower and does not accurately represent the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about a decentralized task marketplace/protocol over XMTP with agent discovery, task posting, bidding, escrow, and USDC payments on Base. The supplied code does none of that. Instead, it is a standalone operational script for XMTP account installation management: it reuses an existing XMTP database, connects an agent, revokes other installations, and inspects remaining installations. This is a materially different primary purpose and introduces an undeclared capability—revoking account installations—that is unrelated to the stated protocol behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about decentralized agent-to-agent task coordination and on-chain escrow/payments. The supplied code does not implement marketplace, bulletin board discovery, task posting, bidding, escrow, or USDC/Base payments. Instead, it is a standalone operational script for XMTP account installation management: it starts an agent, lists installations, and revokes all but the current installation. That is a materially different primary purpose and an undeclared capability, so this is a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a full decentralized agent task marketplace/protocol with XMTP-based discovery and coordination plus escrowed payments. The supplied code does not implement any of those behaviors. Instead, it is a simple USDC transfer script on Base that takes a private key, destination address, and amount, checks balance, and sends tokens directly. This is a materially different primary purpose and includes an undeclared direct fund-transfer capability, so the description does not accurately represent the code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents a full decentralized task marketplace and payment protocol, including discovery, work bidding, escrow, and USDC payouts on Base. The supplied code chunk does not implement those capabilities. Instead, it provides low-level XMTP communication primitives: agent creation from a private key, group creation, JSON message sending, and typed message handling. While these messaging utilities could support such a protocol, they do not themselves realize the described core behavior. Therefore the description materially overstates what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The description presents a full decentralized agent-task protocol centered on XMTP messaging, bulletin-board discovery, task posting, bidding, and on-chain payments. The supplied code only covers the escrow/payment portion: interacting with a TaskEscrow contract and USDC token on Base, including deployment and lifecycle operations for escrow and disputes. While escrowed payment is consistent with part of the description, the primary declared scope is much broader than what this code actually does. Additionally, the code includes deployment of the escrow contract, which is a capability not explicitly declared. This is therefore a material description-behavior mismatch, though the payment/escrow aspect is accurately represented.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description centers on a decentralized XMTP-based protocol for agent discovery, task posting, bidding, escrow, and on-chain USDC payments on Base. In contrast, the supplied code chunk is an executor module whose primary purpose is to carry out tasks on the local machine. It launches local agent binaries (codex/claude/pi), performs web research, clones GitHub repos, inspects files, and writes outputs to disk. These are materially different capabilities from the declared marketplace/protocol and involve resource access not described in the declaration, including local process execution, filesystem access, outbound HTTP requests, and git/network operations. While such an executor could be a supporting component of a larger system, the code shown does not implement the description's core advertised behavior and instead exposes substantial undeclared execution functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a broad decentralized agent-to-agent task marketplace/protocol with discovery, bulletin boards, task posting, bidding, and coordination over XMTP plus on-chain payments. The supplied code only implements the payment/escrow portion: interacting with a TaskEscrowV3 contract and USDC for milestone-based escrow creation, release, disputes, refunds/timeouts via ABI exposure, and status queries. There is no XMTP messaging, no agent discovery, no bulletin board interactions, no bidding/work matching, and no broader task-protocol orchestration in this chunk. While escrow payments are consistent with part of the description, the actual behavior is materially narrower than the declared purpose, so the description does not accurately represent what this code chunk itself does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The supplied code only implements a registry and membership layer for boards: reading boards from a Base contract, registering a board, requesting to join, approving joins, and fetching pending requests. While this partially aligns with the 'discover agents via bulletin boards' portion of the description, it does not implement the broader declared purpose of a decentralized task protocol. There is no code for posting tasks, bidding, assigning work, escrow contracts, handling payments, transferring USDC, or coordinating task lifecycle events. The primary behavior is therefore narrower and materially different from the full declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a full decentralized agent coordination and paid task protocol built on XMTP, including discovery, task posting, bidding, escrow, and USDC payments. The supplied code chunk instead only wraps a staking contract: approving USDC, depositing stake, withdrawing stake, locking stake against a task ID, checking balances, and handling emergency withdrawal. While locking stake for a task is plausibly related to a bidding/task system, this is only one supporting component and not the broader functionality described. The primary purpose of the code is stake management, not XMTP-based agent coordination or escrowed task execution/payments.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared description presents a full decentralized task marketplace/protocol centered on XMTP discovery, posting tasks, bidding, escrow, and USDC payment settlement. The supplied code chunk does not implement those marketplace/coordinator functions. Instead, it is a narrower verification module that records hashes and verification outcomes on-chain and performs off-chain verification by writing files, executing tests locally, and calling external AI tooling. Some of this may be a companion feature within the broader system, but the actual behavior in this chunk includes materially different capabilities—especially local code execution and filesystem access—that are not reflected in the declared description. Therefore this chunk is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about a decentralized task marketplace/protocol using XMTP, bulletin boards, bidding, escrow, and agent coordination. The supplied code does not implement agent discovery, messaging, bulletin boards, task posting, bidding, escrow logic, or XMTP interactions. Instead, its primary purpose is wallet security: wrapping a wallet with transaction guardrails, enforcing USDC spending limits, restricting destinations, logging activity, and managing config. While wallet safety could be a supporting component in a broader payment system, this chunk’s actual behavior is materially different from the declared protocol functionality and introduces undeclared wallet-control capabilities as its main purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a decentralized agent coordination and task marketplace protocol over XMTP with discovery, bidding, escrow, and payments. The supplied code does none of that. It is a wallet/payment helper focused on Base mainnet asset operations: provider creation, wallet loading from environment/private key, balance checks, ETH→USDC swaps through Uniswap, and USDC transfers. While USDC payments on Base are tangentially related, the primary behavior is materially different and omits the core declared features. Additionally, the code introduces undeclared financial capabilities such as automated token swapping and direct wallet/private-key handling.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The escrow release command sends an irreversible on-chain payout immediately after a task-id is provided, with no confirmation prompt, summary, or secondary approval. A mistaken command, script misuse, or malicious automation invoking this CLI could permanently transfer funds to the worker with no recovery path.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The refund command performs a direct contract refund transaction as soon as it is called, without a confirmation step or preflight summary. Because blockchain transactions are irreversible and refund eligibility may depend on timing or task state, accidental invocation can create permanent and possibly disputed fund movements.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Releasing a milestone triggers an on-chain payout immediately after task ID and milestone index are supplied, without user confirmation. This is dangerous because milestone payouts are typically final and a wrong index or wrong task can cause unrecoverable premature payment.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

Category: Supply Chain
Confidence: 89% confidence
Finding: The lockfile pins axios 1.13.5, and the finding cites multiple advisories including SSRF and prototype-pollution-related request manipulation issues. In this skill, axios is pulled in through blockchain/payment and agent-coordination dependencies, so outbound HTTP requests are plausible; if attacker-controlled URLs, proxy settings, or redirect behavior are ever reachable, these flaws can become exploitable.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tool Parameter Abuse

Chaining Abuse

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

Anti-Refusal Statement

wallet guard (v3.1)

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Missing User Warnings

Missing User Warnings

Missing User Warnings