Security audit

swarma - growth loops

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned, but needs Review because it asks users to install and run an unpinned external CLI, store an API key in plaintext, and makes a local-only data claim despite OpenRouter LLM use.

Review before installing. Use a virtual environment, pin or verify the swarma package/repository version, avoid putting real secrets or customer data into experiment prompts, store the OpenRouter key with owner-only permissions or a secret manager, and treat generated strategies, metrics, and playbooks as persistent local business data.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:127
Finding: Unpinned Third-Party Package Installation
Content: View full analysis
Remediation: View remediation
" ``` 2. Publish and verify SHA-256 hashes, using a requirements file with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. For source installation, pin and verify an immutable commit or signed tag rather than the default branch. 4. Document the expected package publisher, repository, release signature, and checksum. 5. Install inside a dedicated virtual environment with no elevated privileges. 6. Audit and lock transitive dependencies. 7. Re-review the installed package whenever the pinned version changes. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:198
Finding: OpenRouter API Key Stored Through an Unsafe Plaintext Shell Command
Content: View full analysis
> ~/.swarma/instances/default/.env ``` ``` The Skill also demonstrates embedding the key directly in MCP configuration: ```json { "mcpServers": { "swarma": { "command": "swarma", "args": ["serve", "--mcp"], "env": { "OPENROUTER_API_KEY": "sk-or-..." } } } } ``` ### Technical Analysis An OpenRouter credential is legitimately required for the declared remote LLM functionality. However, the documented setup method encourages users to substitute a real long-lived API key into a shell command and write it to a plaintext file. This design creates several avoidable exposure channels: - The command containing the key may remain in shell history. - The `.env` or MCP configuration may have permissions broader than the owner unless restrictive permissions are explicitly applied. - Plaintext configurations may be collected by backups, diagnostics, synchronization tools, or accidental repository commits. - Append mode can leave multiple current or obsolete credentials in the same file. - Child processes receiving the environment variable may be able to read it. - The documentation provides no secret rotation, redaction, or incident-response guidance. No hardcoded real key is present in the audited file; `sk-or-...` is a placeholder. The vulnerability is the insecure credential-handling procedure. ### Attack Path 1. A user replaces `sk-or-...` with a valid OpenRouter API key. 2. The user executes the documented `echo` command or stores the key in an MCP configuration. 3. The key remains in shell history and/or a plaintext configuration file. 4. Another local process, user with sufficient ...[truncated 899 chars]
Remediation: View remediation
~/.swarma/instances/default/.env unset OPENROUTER_API_KEY ``` 4. Replace the file rather than blindly appending duplicate or obsolete credentials. 5. Add the `.env` and relevant MCP configuration files to applicable ignore and backup-exclusion rules. 6. Warn users not to paste keys into logs, tickets, transcripts, or version control. 7. Document credential rotation and immediate revocation after suspected disclosure. 8. Scope the API key and set provider-side spending limits where supported. ]]>

other

Note

Location: SKILL.md:545
Finding: Unqualified Local-Only Data Claim Despite Remote LLM Processing
Content: View full analysis
20% = keep/discard | `core/experiment.py` | | **S -- Stack** | Validated patterns written to `strategy.md` + playbook | `core/agent.py` | ``` It also declares that OpenRouter is required: ```yaml required_environment_variables: - name: OPENROUTER_API_KEY prompt: "OpenRouter API key for LLM calls" help: https://openrouter.ai/keys required_for: running agent cycles ``` However, it makes this unconditional statement: ```text | **a hosted service** | -- | self-hosted. your data stays on your machine. | ``` ### Technical Analysis The Skill explicitly requires OpenRouter for LLM calls and states that a separate LLM evaluates experiment output. Remote inference necessarily transmits at least some request content to an external endpoint. Therefore, the unconditional statement that user data “stays on your machine” is misleading unless all model inference is local or the claim is narrowly limited to stored application state. The unavailable package implementation prevents determining exactly which fields are transmitted, which model providers receive them, or whether additional telemetry exists. Accordingly, this finding does not assert covert exfiltration. It identifies a mismatch between the documented remote-processing architecture and the local-only privacy assurance. ### Attack Pa ...[truncated 1063 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.
After swarma init, add your API key:

bash
echo "OPENROUTER_API_KEY=sk-or-..." >> ~/.swarma/instances/default/.env

Get a key at openrouter.ai/keys.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.
After swarma init, add your API key:

bash
echo "OPENROUTER_API_KEY=sk-or-..." >> ~/.swarma/instances/default/.env

Get a key at openrouter.ai/keys.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill repeatedly instructs users to provide goals, context, topics, and generated outputs to swarma while requiring an OPENROUTER_API_KEY, but it does not clearly warn that these data are transmitted to an external LLM provider. Users may unintentionally send proprietary business data, customer information, or sensitive prompts off-host under the impression that the tool is purely local/self-hosted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document says the strategy file evolves automatically, but it does not clearly warn that validated patterns and experiment results are persistently written to local files. This can lead users to store sensitive campaign data, internal strategy, or regulated content on disk without realizing it will be retained and may later be read by other tools or users on the system.
Content: No source excerpt is available for this finding.