Speckit Swarm

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:24 PM UTC
• Version: 1.1.0

Overview

This orchestration skill is mostly coherent, but it can automatically prepare parallel coding agents for bug fixes and refactors without enforcing its own safety checks.

Review before installing. Use this only in repositories where automatic multi-agent edits are acceptable, preferably on a clean branch, and require an explicit plan or confirmation before running parallel_spawn for refactors, bug fixes, migrations, shared configuration, or same-file edits. I found no evidence of credential theft, persistence, or remote-code execution.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: ultrawork-handler.ts:44
• Finding: Concurrency Safety Checks Are Bypassed During Automatic Parallel Execution<![CDATA[ ## Vulnerability Details **File Location**: `ultrawork-handler.ts:44-72, 95-98, 121-169`; related unused safeguards in `src/concurrency.ts:20-78, 121-145` **Vulnerability Type**: Unsafe parallel execution of dependent or conflicting tasks **Risk Level**: Medium ### Vulnerable Code The automatic classifier treats refactoring and bug-fixing requests as candidates for parallel execution: ```typescript export function shouldAutoParallelize(task: string): boolean { const keywords = ['ulw', 'ultrawork', 'parallel']; const hasKeyword = keywords.some(k => task.toLowerCase().includes(k)); // Also detect by complexity const complexPatterns = [ /criar\s+(um?\s+)?(novo|nova)/i, /implementar/i, /construir/i, /refatorar/i, /reescrever/i, /migrar/i, /criar\s+.*api/i, /criar\s+.*cli/i, /criar\s+.*projeto/i, /criar\s+.*app/i, /build\s+/i, /corrigir\s+o?\s*bug/i, /fix\s+(the\s+)?bug/i, /consertar/i, ]; const isComplex = complexPatterns.some(p => p.test(task.toLowerCase())); return hasKeyword || isComplex; } ``` The preparation path proceeds directly to planning without invoking the concurrency safeguards implemented in `src/concurrency.ts`: ```typescript // Detectar se tem prefixo ulw para limpar const cleanedTask = task.replace(/^(ulw|ultrawork)\s*/i, '').trim(); // Execute o planner const plan = planSimpleTask(cleanedTask); ``` The planner then returns logically dependent bug-fixing tasks as a single collection intended for `parallel_spawn`: ```typescript if (lower.includes('fix') || lower.includes('bug')) { return { mainTask: task, chunks: [ { label: 'debug', task: `Find and understand bug: ${task}. Find root cause.`, persona: 'oracle' }, { label: 'fix', task: `Fix bug: ${task}.`, persona: 'hephaestus' }, { label: 'verify', task: `Verify fix: ${task}.`, persona: 'explore' }, ], }; } ``` Refactoring tasks are handled similarly: ```typescript if ...[truncated 3123 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. **Enforce concurrency analysis in the active execution path** - Import and invoke `analyzeTask()` or `checkConcurrencySafety()` inside `prepareParallelExecution()`. - Do not return a parallel-executable batch unless the result explicitly recommends `parallel`. 2. **Default conflicting operations to sequential execution** - Treat bug fixes, refactors, migrations, same-file edits, and shared configuration changes as sequential unless independence has been established. - Return `shouldExecute: false` or an explicit sequential strategy for uncertain cases. 3. **Model task dependencies** - Populate the existing `dependsOn` field for task chunks. - For example, make `fix` depend on `debug`, and make `verify` depend on `fix`. - Execute chunks in topological stages, parallelizing only independent chunks within the same stage. 4. **Separate read-only and modifying tasks** - Permit parallel execution for independent read-only analysis. - Ensure that tasks with `write`, `edit`, package installation, build generation, or other mutating capabilities do not concurrently target shared resources. 5. **Require explicit conflict information** - Resolve each chunk to its anticipated files or directories before execution. - Reject or serialize chunks with overlapping write sets. 6. **Add regression tests** - Verify that `fix bug`, `refactor`, same-file edits, and shared-module changes never produce an unrestricted parallel write batch. - Verify that explicitly independent, disjoint-file tasks remain eligible for parallel execution. - Test that dependency ordering is enforced before verification begins. 7. **Align documentation and implementation** - Ensure the active handler follows the sequential behavior promised by `SKILL.md`. - Document whether `shouldExecute` means parallel execution specifically or any orchestrated execution. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

prompt = `${persona.prompt}\n\n---\n\nTask: ${chunk.task}`;
  }
  
  return prompt;
}

/**

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The skill first describes ultrawork as automatically decomposing tasks and executing them with parallel_spawn, then later claims concurrency-safety checks are performed before parallelization. If an implementer follows the earlier unconditional flow, multiple agents may concurrently modify overlapping files or state, causing race conditions, corrupted outputs, or unsafe automated changes in repositories.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The complexity detection rules and multi-step phrase matching are predominantly written for Portuguese inputs, while the file comments claim general task analysis. This creates an implicit language policy that favors one locale without user opt-in or clear justification, which can cause inconsistent behavior for users writing tasks in other languages.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The matcher relies primarily on Portuguese-language regex patterns and comments, with only limited English coverage, which means task analysis behavior is effectively constrained to a specific language. This is a natural-language policy concern because the file does not provide user opt-in, fallback handling, or a documented locale limitation for non-Portuguese inputs.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The prompt explicitly tells the agent not to seek confirmation at every step and to proceed on assumptions, but it does not add any safety boundary for high-impact actions such as destructive file edits, credential use, network access, or privileged operations. In an autonomous agent with exec/read/write/edit/web capabilities, this increases the chance that ambiguous or maliciously framed tasks will be carried through without adequate user approval.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: Instructing the agent to make code indistinguishable from human-written output encourages concealment of AI generation rather than transparency. While not directly enabling code execution abuse on its own, it can hinder auditability and provenance review, especially if the agent introduces risky changes that reviewers assume were manually authored.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The handler is explicitly designed to auto-detect 'complex' tasks and prepare parallel execution for implementation, setup, refactoring, and bug-fix work without any user-facing confirmation gate. Because it converts broad natural-language requests into multiple code-generating sub-tasks such as 'Initialize project' and 'Implement core functionality,' it can amplify unintended or unsafe actions and reduce user visibility into what will be executed.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The documentation first tells users to import and call `shouldUseUltrawork` at L095-L100, but the later exported-functions section documents `containsUltrawork` and `prepareUltrawork` instead at L118-L126. These are not merely incomplete docs; they describe inconsistent public interfaces for the same detection/preparation behavior, creating intent-code divergence within the skill documentation.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The file is primarily written in English, but key usage and API description sections switch to Portuguese, such as the handler description and exported-function comments. This can impose a language expectation on users without opt-in or justification, which matches the locale/language policy concern.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The exported-functions section documents `prepareUltrawork` as the function that prepares ultrawork execution, but the later example calls `prepareParallelExecution` at L181. This is an active contradiction in the documented behavior/interface rather than a minor omission, because users are shown two different functions for the same task-preparation role.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: This TypeScript file documents that the system will detect an "ulw" keyword for automatic ultrawork mode, but it does not provide any user-facing warning, confirmation, or explanation of what automatic ultrawork mode does. Because this describes an automatic behavioral change triggered by user text, the lack of disclosure can surprise users even if the underlying implementation is elsewhere.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The prompt states that the Librarian persona has the `exec` tool available, which enables running commands. This is a safety-relevant operation for a research-oriented skill, but the file provides no warning, confirmation requirement, or disclosure about command execution behavior.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: The file's natural-language instructions are partly in Portuguese, while several generated task prompts are in English. There is no indication that the user can choose the output language or that the language behavior is constrained to a documented locale-specific context.