Swarm

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:32 PM UTC
• Version: 1.6.0

Overview

This research skill is review-worthy because it can search past sessions and other projects and write a report without clearly limiting or confirming that private-data access.

Review this skill before installing if your environment has Solograph or similar MCP tools connected to private sessions or repositories. Use it only when you are comfortable with agents searching prior conversations, project metadata, and code across available projects, and with creating or updating docs/research.md in the current repository. Prefer disabling Bash and limiting internal search tools to an explicitly chosen project/session unless you need them.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:10

Finding

Excessive Access to Historical Sessions, Cross-Project Code, and Shell Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:10, SKILL.md:34, SKILL.md:43-46
Vulnerability Type: Violation of least privilege through unnecessary tool permissions
Risk Level: Medium

Evidence

yaml

allowed-tools: Read, Grep, Glob, Bash, WebSearch, WebFetch, Write, mcp__solograph__web_search, mcp__solograph__kb_search, mcp__solograph__project_info, mcp__solograph__codegraph_query, mcp__solograph__codegraph_explain, mcp__solograph__project_code_search, mcp__solograph__session_search

markdown

- If MCP `session_search` available: check if this idea was researched before in past sessions

markdown

- If MCP `project_info` available: check existing projects for reusable code
- If MCP `codegraph_explain` available: get architecture overview of similar existing projects
- If MCP `codegraph_query` available: find shared packages across projects
- If MCP `project_code_search` available: search for reusable patterns, services, infrastructure across existing projects

Technical Analysis

The skill's declared purpose is to research an idea from market, user, and technical perspectives. That workflow legitimately requires web-search and document-writing capabilities, but it does not inherently require unrestricted shell access, searches of historical sessions, or access to source code and metadata from unrelated projects.

Granting Bash without defining a necessary shell operation expands the skill's execution authority beyond its documented requirements. Similarly, mcp__solograph__session_search can expose prior conversation content, while the project and code-graph tools can disclose proprietary source code, architecture, services, or infrastructure belonging to projects outside the current research scope.

The instructions explicitly encourage agents to use these capabilities, but do not require user approval, constrain searches to a named project, limit returned data, or prohibi ...[truncated 1899 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Bash from allowed-tools because no shell operation is required by the documented workflow.
2. Remove mcp__solograph__session_search by default. If prior-session research is an optional feature, require explicit informed user approval before each search.
3. Restrict project_info, codegraph_query, codegraph_explain, and project_code_search to the current repository or to a project explicitly selected by the user.
4. Require a confirmation prompt that identifies the target session or project before any cross-session or cross-project access occurs.
5. Apply backend authorization filters so the agent cannot enumerate projects, sessions, or code beyond the approved scope.
6. Minimize retrieved data and redact secrets, personal information, credentials, internal URLs, and unrelated proprietary content before writing docs/research.md.
7. Treat all web and MCP search results as untrusted data rather than executable instructions. Explicitly prohibit following tool-use directions embedded in retrieved content.
8. Add provenance metadata to synthesized findings so reviewers can identify whether information came from the public web, a prior session, or an internal project.
9. If shell access is later required for a specific feature, replace unrestricted Bash with a narrowly scoped operation, enforce repository-root confinement, use command allowlisting, and require approval for side-effecting commands.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs the agent to write research.md into docs/ in the current project directory, but it does not prominently warn the user up front that running the skill will modify the local workspace. This can lead to unexpected file creation or overwriting in a repository, especially when the user believes the skill is read-only research assistance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.