Cluster Agent Swarm

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:45 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed platform-operations swarm, but it asks users to install mutable remote content for high-impact cluster and cloud workflows without pinning or integrity checks.

Review this before installing in any environment with real cluster, cloud, GitOps, registry, or repository credentials. Prefer a pinned commit or signed release, verify provenance, install in a least-privileged sandbox first, and only grant production access after confirming the complete referenced skill files and scripts match what was reviewed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:46

Finding

Unpinned Remote Skill Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:46-73
Vulnerability Type: Unpinned third-party CLI and mutable remote Skill sources
Risk Level: Medium

The installation instructions execute an unversioned npm CLI through npx and install Skill content from mutable GitHub repository paths:

bash

npx skills add https://github.com/kcns008/cluster-agent-swarm-skills

# Orchestrator - Task routing and coordination
npx skills add https://github.com/kcns008/cluster-agent-swarm-skills/skills/orchestrator

# Cluster Ops - Atlas (cluster operations)
npx skills add https://github.com/kcns008/cluster-agent-swarm-skills/skills/cluster-ops

# GitOps - Flow (ArgoCD, Helm, Kustomize)
npx skills add https://github.com/kcns008/cluster-agent-swarm-skills/skills/gitops

# Security - Shield (RBAC, policies, CVEs)
npx skills add https://github.com/kcns008/cluster-agent-swarm-skills/skills/security

# Observability - Pulse (metrics, alerts, incidents)
npx skills add https://github.com/kcns008/cluster-agent-swarm-skills/skills/observability

# Artifacts - Cache (registries, SBOM, promotions)
npx skills add https://github.com/kcns008/cluster-agent-swarm-skills/skills/artifacts

# Developer Experience - Desk (namespaces, onboarding)
npx skills add https://github.com/kcns008/cluster-agent-swarm-skills/skills/developer-experience

Technical Analysis

The command does not pin the skills npm package to a reviewed version. It also references GitHub content without an immutable commit hash, verified release artifact, checksum, or cryptographic signature. Consequently, the effective installation behavior and installed Skill instructions may change after this artifact has been audited.

The project artifact contains only SKILL.md, although its documentation advertises additional agent definitions, scripts, and references. Those remote components were therefore unavailable for review. This does not establish that the u ...[truncated 1897 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm CLI to a specifically reviewed version, for example by using an exact package version rather than allowing npx to resolve the latest release.
2. Reference the remote repository by an immutable full commit SHA instead of a mutable default branch or directory URL.
3. Vendor the required Skill files, scripts, and references into the audited project so their complete behavior can be reviewed before installation.
4. Publish signed release artifacts and verify their cryptographic signatures or SHA-256 checksums before installation.
5. Use a lockfile and an approved internal package registry or mirror for installation tooling where practical.
6. Run installation in a sandboxed, least-privileged environment without production cluster, cloud, registry, or Git credentials.
7. Add automated dependency and repository integrity monitoring, including alerts for unexpected changes to pinned artifacts.
8. Require security review and provenance verification before updating either the pinned CLI version or repository commit.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (15)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to run npx skills add against a remote GitHub source without any version pinning, commit pinning, or integrity verification. In a platform-operations skill with broad Kubernetes/OpenShift tooling, this creates a supply-chain risk where a later upstream change or repo compromise could deliver altered agent behavior or malicious content into a privileged operational environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This line again recommends npx skills add from a mutable remote repository path with no pinned version. Because the skill is intended for cluster administration workflows, a compromised or changed upstream source could alter prompts, scripts, or instructions in ways that influence privileged operations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The installation command for the individual skill is unpinned and fetched from a remote GitHub path. This exposes consumers to repository drift and supply-chain compromise, especially dangerous here because the skill advertises access to infrastructure tools like kubectl, oc, cloud CLIs, and GitOps tooling.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This unpinned npx skills add reference allows installation of whatever content exists at the remote path at execution time. In the context of cluster operations, that could silently change operational guidance or embedded automation affecting upgrades, scaling, or other privileged workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The command installs the GitOps-related skill from a mutable remote location with no version or integrity pin. Since GitOps agents can influence deployment state and reconciliation behavior, a malicious update could steer deployments, introduce unsafe manifests, or manipulate rollback/sync instructions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This line installs the security-focused skill from an unpinned remote path. A malicious or altered upstream version could subvert audits, suppress warnings, or provide dangerous remediation steps while appearing authoritative in a sensitive security context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The observability skill is fetched via npx skills add without pinning, making the installed content dependent on the current state of a remote repository. In production operations, compromised observability guidance could misdirect incident response, hide meaningful signals, or encourage risky diagnostic actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This installation command for another sub-skill is likewise unpinned and mutable. Because the swarm spans multiple operational domains, each unpinned install increases the attack surface for prompt-level or workflow-level supply-chain compromise across cluster, artifact, or developer-experience operations.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 266)May include surrounding context.

md

## Reference Documentation

For detailed capabilities of each agent, refer to individual SKILL.md files:
- `skills/orchestrator/SKILL.md` - Full Orchestrator documentation
- `skills/cluster-ops/SKILL.md` - Full Cluster Ops documentation
- `skills/gitops/SKILL.md` - Full GitOps documentation
- `skills/security/SKILL.md` - Full Security documentation

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.

md

For detailed capabilities of each agent, refer to individual SKILL.md files:
- `skills/orchestrator/SKILL.md` - Full Orchestrator documentation
- `skills/cluster-ops/SKILL.md` - Full Cluster Ops documentation
- `skills/gitops/SKILL.md` - Full GitOps documentation
- `skills/security/SKILL.md` - Full Security documentation
- `skills/observability/SKILL.md` - Full Observability documentation

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 268)May include surrounding context.

md

For detailed capabilities of each agent, refer to individual SKILL.md files:
- `skills/orchestrator/SKILL.md` - Full Orchestrator documentation
- `skills/cluster-ops/SKILL.md` - Full Cluster Ops documentation
- `skills/gitops/SKILL.md` - Full GitOps documentation
- `skills/security/SKILL.md` - Full Security documentation
- `skills/observability/SKILL.md` - Full Observability documentation
- `skills/artifacts/SKILL.md` - Full Artifacts documentation

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.

md

- `skills/orchestrator/SKILL.md` - Full Orchestrator documentation
- `skills/cluster-ops/SKILL.md` - Full Cluster Ops documentation
- `skills/gitops/SKILL.md` - Full GitOps documentation
- `skills/security/SKILL.md` - Full Security documentation
- `skills/observability/SKILL.md` - Full Observability documentation
- `skills/artifacts/SKILL.md` - Full Artifacts documentation
- `skills/developer-experience/SKILL.md` - Full Developer Experience documentation

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

md

- `skills/cluster-ops/SKILL.md` - Full Cluster Ops documentation
- `skills/gitops/SKILL.md` - Full GitOps documentation
- `skills/security/SKILL.md` - Full Security documentation
- `skills/observability/SKILL.md` - Full Observability documentation
- `skills/artifacts/SKILL.md` - Full Artifacts documentation
- `skills/developer-experience/SKILL.md` - Full Developer Experience documentation

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 271)May include surrounding context.

md

- `skills/gitops/SKILL.md` - Full GitOps documentation
- `skills/security/SKILL.md` - Full Security documentation
- `skills/observability/SKILL.md` - Full Observability documentation
- `skills/artifacts/SKILL.md` - Full Artifacts documentation
- `skills/developer-experience/SKILL.md` - Full Developer Experience documentation

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

md

- `skills/security/SKILL.md` - Full Security documentation
- `skills/observability/SKILL.md` - Full Observability documentation
- `skills/artifacts/SKILL.md` - Full Artifacts documentation
- `skills/developer-experience/SKILL.md` - Full Developer Experience documentation

Static analysis

No suspicious patterns detected.