ClawHub
Back to skill

Security audit

ia-orchestrating-swarms

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed multi-agent orchestration guide; its sensitive behaviors are mostly bounded to expected swarm coordination and debugging.

Install this only if you want agents to coordinate multi-agent work. Expect it to spawn or message workers when the host exposes those tools, create/update task records, and read current Claude team/task files for debugging; review worker prompts and shutdown/cleanup decisions for sensitive projects.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SPEC.md (reported line 16)May include surrounding context.

md
Out of scope:
- Acting as the runtime instructions themselves (those live in `SKILL.md`).
- Trigger phrasings already covered by adjacent `ia-*` skills (`validate-plugin` flags >70% description overlap as DUPLICATE_TRIGGER).
- <!-- to fill in: domain-specific exclusions when the skill drifts -->

## Trigger Context

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/context-carry-forward.md (reported line 11)May include surrounding context.

md
| **Rewind** | `Esc Esc` (double-escape); keeps the useful prefix, drops the tail | Recovering from a failed attempt. Drops the failure from context without losing the useful reads that came before it. Beats "correcting" in place because correction keeps the failed path visible. |
| **/compact** | Lossy summarization into a short digest | Long sessions where the earlier turns no longer matter but their conclusions do |
| **Subagent** | Spawn a subagent for the task; only the result returns to main context | Contained research, focused implementation, or anything that would balloon main-thread context |
| **/clear + brief** | Clear context; restart with a hand-written brief | Mode switch (different feature, different skill needed). Cleaner than compaction when you know what still matters. |

## Why Rewind is underused

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/environment-config.md (reported line 83)May include surrounding context.

bash
# Check team config
cat ~/.claude/teams/{team}/config.json | jq '.members[] | {name, agentType, backendType}'

# Check teammate inboxes
cat ~/.claude/teams/{team}/inboxes/{agent}.json | jq '.'

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/environment-config.md (reported line 86)May include surrounding context.

bash
# Check team config
cat ~/.claude/teams/{team}/config.json | jq '.members[] | {name, agentType, backendType}'

# Check teammate inboxes
cat ~/.claude/teams/{team}/inboxes/{agent}.json | jq '.'

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/environment-config.md (reported line 92)May include surrounding context.

bash
# Check team config
cat ~/.claude/teams/{team}/config.json | jq '.members[] | {name, agentType, backendType}'

# Check teammate inboxes
cat ~/.claude/teams/{team}/inboxes/{agent}.json | jq '.'

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/spawn-backends.md (reported line 149)May include surrounding context.

bash
# Check team config
cat ~/.claude/teams/{team}/config.json | jq '.members[] | {name, agentType, backendType}'

# Check teammate inboxes
cat ~/.claude/teams/{team}/inboxes/{agent}.json | jq '.'

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/environment-config.md (reported line 95)May include surrounding context.

cat ~/.claude/tasks/{team}/*.json | jq '{id, subject, status, owner, blockedBy}'

Watch for new messages

tail -f ~/.claude/teams/{team}/inboxes/team-lead.json

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/task-system.md (reported line 3)May include surrounding context.

md
# Task System Integration

> When to read: when integrating TaskCreate / TaskUpdate / TaskList into a swarm and needing the exact tool call shapes for work-item dispatch.

## TaskCreate - Create Work Items

Static analysis

No suspicious patterns detected.