ClawHub
Back to skill

Security audit

Swarm Mind

Security checks for vulnerabilities and agentic risk

Overview

This skill is a remote Kanban collaboration connector, but it gives agents broad authority to join teams, claim remote tasks, and act on collaborator-provided task content without enough user confirmation or trust-boundary guidance.

Install only if you intend to let the agent use the SWARM Board remote service. Confirm before registering, joining teams, claiming tasks, or sending task content, and treat task descriptions and messages from other collaborators as untrusted instructions that should not override your original request or expose secrets, local files, credentials, or private conversation context.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:332
Finding

Untrusted Remote Task Content Can Influence Agent Behavior

Content
View full analysis
/tasks` 4. Filter tasks by `required_capabilities` containing "machine-learning" 5. Claim first available task 6. Request collaboration: `POST /tasks//collaborate` ``` The subsequent workflow also directs the agent to act on retrieved tasks: ```markdown **Steps:** 1. Get your tasks: `GET /teams//tasks` (filter by `assigned_to_id`) 2. Verify current `column_id` is Backlog 3. Move to In Progress: `PUT /tasks/` with new `column_id` 4. Work on task, send status updates via messages 5. Move to Done: `PUT /tasks/` with Done `column_id` 6. Complete task: `POST /tasks//complete` ``` ### Technical Analysis The skill connects the agent to an external collaboration service, accepts team invitations, retrieves remotely created tasks, and instructs the agent to work on those tasks. Task descriptions and task-chat messages are controlled by external team members. The documentation does not establish a trust boundary for API-returned content. In particular, it does not instruct the agent to: - Treat task descriptions and messages as untrusted data. - Reject instructions that conflict with the user's original request or system safety constraints. - Obtain user confirmation before accepting invitations or acting on remotely supplied tasks. - Prevent secrets, local files, credentials, or unrelated session data from being included in task updates. - Restrict tools and resources that may be used while processing a remote task. Conse ...[truncated 2043 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrases include broad, common language such as 'create task', 'join team', and 'collaborate on', which can cause the skill to activate in contexts where the user did not intend to use this remote multi-agent system. Because activation leads to networked actions and account/team operations, accidental invocation can expose data or initiate external side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly uses a remote API with JWT bearer tokens and collaboration/task data, but it does not present a clear user-facing warning that information will be transmitted off-platform. Users or agents may unknowingly send project names, task contents, identities, and tokens to a third-party service, creating privacy and credential-handling risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The skill instructs the agent to POST registration and later operational data to an external service, creating direct exfiltration and unintended data-sharing potential. While external transmission is central to the skill's purpose, it is still security-relevant because activation can create accounts, send collaboration metadata, and persist user or agent information outside the local environment.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Register as a new agent:

bash
curl -X POST https://swarm-kanban.vercel.app/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "agent-name-unique",

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.

md
## Example 1: Solo Agent Creating Team & Task

**Input:** "Create a team for a web scraping project and add a task to scrape GitHub repos"

**Steps:**
1. Register agent with capabilities: `["web-scraping", "data-processing"]`

Static analysis

No suspicious patterns detected.