Speckit Swarm

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:24 PM UTC
• Version: 1.1.0

Overview

This orchestration skill is mostly coherent, but it can automatically prepare parallel coding agents for bug fixes and refactors without enforcing its own safety checks.

Review before installing. Use this only in repositories where automatic multi-agent edits are acceptable, preferably on a clean branch, and require an explicit plan or confirmation before running parallel_spawn for refactors, bug fixes, migrations, shared configuration, or same-file edits. I found no evidence of credential theft, persistence, or remote-code execution.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: ultrawork-handler.ts:44

Finding

Concurrency Safety Checks Are Bypassed During Automatic Parallel Execution

Content

View full analysis

task.toLowerCase().includes(k)); // Also detect by complexity const complexPatterns = [ /criar\s+(um?\s+)?(novo|nova)/i, /implementar/i, /construir/i, /refatorar/i, /reescrever/i, /migrar/i, /criar\s+.*api/i, /criar\s+.*cli/i, /criar\s+.*projeto/i, /criar\s+.*app/i, /build\s+/i, /corrigir\s+o?\s*bug/i, /fix\s+(the\s+)?bug/i, /consertar/i, ]; const isComplex = complexPatterns.some(p => p.test(task.toLowerCase())); return hasKeyword || isComplex; } ``` The preparation path proceeds directly to planning without invoking the concurrency safeguards implemented in `src/concurrency.ts`: ```typescript // Detectar se tem prefixo ulw para limpar const cleanedTask = task.replace(/^(ulw|ultrawork)\s*/i, '').trim(); // Execute o planner const plan = planSimpleTask(cleanedTask); ``` The planner then returns logically dependent bug-fixing tasks as a single collection intended for `parallel_spawn`: ```typescript if (lower.includes('fix') || lower.includes('bug')) { return { mainTask: task, chunks: [ { label: 'debug', task: `Find and understand bug: ${task}. Find root cause.`, persona: 'oracle' }, { label: 'fix', task: `Fix bug: ${task}.`, persona: 'hephaestus' }, { label: 'verify', task: `Verify fix: ${task}.`, persona: 'explore' }, ], }; } ``` Refactoring tasks are handled similarly: ```typescript if ...[truncated 3123 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · src/ultrawork.ts (reported line 40)May include surrounding context.

ts

prompt = `${persona.prompt}\n\n---\n\nTask: ${chunk.task}`;
  }
  
  return prompt;
}

/**

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill first describes ultrawork as automatically decomposing tasks and executing them with parallel_spawn, then later claims concurrency-safety checks are performed before parallelization. If an implementer follows the earlier unconditional flow, multiple agents may concurrently modify overlapping files or state, causing race conditions, corrupted outputs, or unsafe automated changes in repositories.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The complexity detection rules and multi-step phrase matching are predominantly written for Portuguese inputs, while the file comments claim general task analysis. This creates an implicit language policy that favors one locale without user opt-in or clear justification, which can cause inconsistent behavior for users writing tasks in other languages.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The matcher relies primarily on Portuguese-language regex patterns and comments, with only limited English coverage, which means task analysis behavior is effectively constrained to a specific language. This is a natural-language policy concern because the file does not provide user opt-in, fallback handling, or a documented locale limitation for non-Portuguese inputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The prompt explicitly tells the agent not to seek confirmation at every step and to proceed on assumptions, but it does not add any safety boundary for high-impact actions such as destructive file edits, credential use, network access, or privileged operations. In an autonomous agent with exec/read/write/edit/web capabilities, this increases the chance that ambiguous or maliciously framed tasks will be carried through without adequate user approval.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Instructing the agent to make code indistinguishable from human-written output encourages concealment of AI generation rather than transparency. While not directly enabling code execution abuse on its own, it can hinder auditability and provenance review, especially if the agent introduces risky changes that reviewers assume were manually authored.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The handler is explicitly designed to auto-detect 'complex' tasks and prepare parallel execution for implementation, setup, refactoring, and bug-fix work without any user-facing confirmation gate. Because it converts broad natural-language requests into multiple code-generating sub-tasks such as 'Initialize project' and 'Implement core functionality,' it can amplify unintended or unsafe actions and reduce user visibility into what will be executed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documentation first tells users to import and call shouldUseUltrawork at L095-L100, but the later exported-functions section documents containsUltrawork and prepareUltrawork instead at L118-L126. These are not merely incomplete docs; they describe inconsistent public interfaces for the same detection/preparation behavior, creating intent-code divergence within the skill documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file is primarily written in English, but key usage and API description sections switch to Portuguese, such as the handler description and exported-function comments. This can impose a language expectation on users without opt-in or justification, which matches the locale/language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The exported-functions section documents prepareUltrawork as the function that prepares ultrawork execution, but the later example calls prepareParallelExecution at L181. This is an active contradiction in the documented behavior/interface rather than a minor omission, because users are shown two different functions for the same task-preparation role.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This TypeScript file documents that the system will detect an "ulw" keyword for automatic ultrawork mode, but it does not provide any user-facing warning, confirmation, or explanation of what automatic ultrawork mode does. Because this describes an automatic behavioral change triggered by user text, the lack of disclosure can surprise users even if the underlying implementation is elsewhere.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The prompt states that the Librarian persona has the exec tool available, which enables running commands. This is a safety-relevant operation for a research-oriented skill, but the file provides no warning, confirmation requirement, or disclosure about command execution behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The file's natural-language instructions are partly in Portuguese, while several generated task prompts are in English. There is no indication that the user can choose the output language or that the language behavior is constrained to a documented locale-specific context.

Content

No source excerpt is available for this finding.