ClawHub
Back to skill

Security audit

Agent Swarm Workflow

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed multi-agent coding workflow, but it gives agents broad authority to edit, commit, and push code without clear user approval safeguards.

Install only if you intentionally want a supervised multi-agent coding workflow. Use a dedicated branch or worktree, verify the Agent Mail/NTM/BV tools, keep secrets out of project files and agent messages, and require human review before any commit or push.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill explicitly instructs agents to 'commit all changed files' and 'push' without requiring confirmation of branch, remote, repository ownership, or review gates. In an autonomous or semi-autonomous setting, this can cause unintended publication of sensitive code, secrets, destructive history on the wrong branch, or side effects against production-linked repositories.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill directs agents to randomly explore code, investigate execution flows, and then 'correct' issues across the project, which authorizes broad modification of existing files without clear scope boundaries or approval checkpoints. In a multi-agent context, this can lead to unintended edits, regressions, policy violations, or modification of sensitive files outside the intended task, especially because the prompt encourages deep and open-ended intervention.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.