Agent Swarm Planner

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:32 AM UTC
• Version: 1.0.0

Overview

This skill is a markdown-only planning aid for designing agent swarms, with mostly safety-oriented guidance and no code execution or data access.

Before installing, be aware that generated templates may include Resomnium branding/contact text and one sample workflow suggests auto-proceeding after a review timeout. For any swarm that affects money, users, accounts, production systems, or private data, change that default to require affirmative approval or halt on timeout.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: templates/swarm-architecture-template.md:157

Finding

Hard-Coded Third-Party Promotion in Generated Architecture Documents

Content

View full analysis

Vulnerability Details

File Location: templates/swarm-architecture-template.md, lines 2-3 and 157-158
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code:

markdown

*Generated by Agent Swarm Planner — Resomnium*
*Date: [YYYY-MM-DD]*

markdown

*Architecture designed with Agent Swarm Planner by Resomnium*
*Questions? → resomnium.com/contact*

Technical Analysis

The reusable output template embeds fixed third-party attribution, branding, and an external contact address in documents generated for users. These elements are not necessary to produce the requested swarm architecture and are presented as mandatory template content rather than optional metadata.

Because the skill controls the model's generated response, these hard-coded instructions can cause unrelated promotional content to be inserted into downstream artifacts without the user's explicit request or consent. This alters the expected output and constitutes output-oriented skill instruction hijacking.

The external address is static text; the reviewed project contains no code that automatically contacts the domain, retrieves a payload, or transmits information.

Attack Path

1. A user loads the Agent Swarm Planner skill and requests a swarm architecture.
2. The agent follows templates/swarm-architecture-template.md when constructing the requested document.
3. The fixed Resomnium attribution and contact address are copied into the generated artifact.
4. The user receives unsolicited third-party promotion presented as part of the requested architecture.
5. The user may interpret the branding as required or trusted project content and manually navigate to the external domain.

Impact Assessment

No operating-system privileges, credentials, or additional system access can be obtained directly through the reviewed content. The impact is limited to generated-output integrity and ...[truncated 395 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the fixed organization name and external contact address from the template.
2. Keep generated documents focused exclusively on content requested by the user.
3. If attribution is operationally required, implement it as an explicit, user-controlled option that is disabled by default.
4. Clearly label any optional attribution as promotional or third-party content rather than presenting it as part of the architecture.
5. Add a release review that checks templates and instruction files for hard-coded branding, URLs, calls to action, and other content unrelated to the skill's declared function.
6. Test generated artifacts to verify that no attribution or external link appears unless the user expressly enables it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md

| Runaway loop | Agent A's output feeds Agent B which modifies Agent A's input | Define maximum iteration count; require human review after N cycles |
| Memory poisoning | Bad output written to shared state, read by downstream agents | Validate writes; maintain write log with rollback capability |
| Scope creep | Agent interprets mandate broadly over time | Scope definition in mandate + regular mandate review |
| Escalation failure | Escalation target unavailable; agent proceeds without approval | Backup escalation target; default to halt, not proceed |
| Coordination deadlock | Two agents waiting on each other | Design directed (not circular) dependencies; add timeouts to every wait |
| Confidence inflation | Agent becomes overconfident over time without error correction | Track error rate; recalibrate if error rate exceeds threshold |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

md

1. **No human oversight point specified**: "Who reviews the swarm's outputs before they have real-world consequences? What's the escalation path?"
2. **Vague goal**: "What does a successful run look like? What artifact or decision does this swarm produce?"
3. **Irreversible actions with no approval gate**: "This action [X] appears irreversible. Should the swarm require human approval before executing it?"
4. **No error scenario discussed**: "What happens if [central agent] fails mid-run? Should the swarm halt, alert, or roll back?"

Do NOT design a swarm that: takes irreversible actions without human approval gates, has no escalation to humans, or runs indefinitely without a defined success/failure state.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The template explicitly includes an '[If no action] → Auto-proceed' path after a human review window, which normalizes executing downstream actions without affirmative approval. In a swarm architecture template, that design pattern can be copied into real deployments and may allow consequential or irreversible actions to occur when reviewers are unavailable, miss notifications, or escalation channels fail.

Content

No source excerpt is available for this finding.