Agent Swarm Workflow

• Outcome: Review
• Latest audit: May 28, 2026 at 1:54 AM UTC
• Version:
  1.0.0

Overview

This skill is a disclosed multi-agent coding workflow, but it tells agents to autonomously edit, commit, and push project changes without clear human approval or branch safeguards.

Install only if you intentionally want a supervised multi-agent coding workflow. Run it on a dedicated branch or worktree, use trusted Agent Mail/NTM/BV tooling, keep secrets out of project instructions and mail messages, and require a human review before any commit or push.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly instructs agents to "commit all changed files" and then "push" to the remote repository, but it does not require an explicit user confirmation, branch restriction, dry-run, or safety check before modifying a shared remote state. In an autonomous multi-agent workflow, this increases the risk of unintended code publication, overwriting collaborative work, or pushing sensitive or low-quality changes directly to a remote repository.

VirusTotal

64/64 vendors flagged this skill as clean.