Grok Swarm

• Outcome: Review
• Latest audit: May 29, 2026 · 9:26 PM UTC
• Version: 1.0.9

Overview

The skill is broadly coherent, but it needs review because it can send selected files to a third-party model service, discover local API credentials, write files, and includes an under-documented arbitrary shell execution option.

Install only if you are comfortable with a coding bridge that can send selected project files to OpenRouter/Grok and make local file changes. Review prompts and file lists before use, avoid including secrets or private data, keep the API key out of repositories and shared logs, and do not use the `--execute` option unless you explicitly intend to run that exact shell command.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Execute command if requested
    if args.execute:
        print(f"\nExecuting: {args.execute}", file=sys.stderr)
        exec_result = subprocess.run(
            args.execute,
            shell=True,
            capture_output=True,

• Confidence: 99% confidence
• Finding: The CLI accepts arbitrary user input via `--execute` and passes it directly to `subprocess.run(..., shell=True)`, enabling unrestricted shell command execution. In an agentic context where model output or automation may influence CLI arguments, this creates a direct path to arbitrary code execution, data exfiltration, or destructive system changes.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The CLI explicitly exposes arbitrary shell-command execution through `--execute` even though the described skill purpose is code generation/orchestration, not command execution. This materially increases danger because generated or operator-supplied content can trigger system-level actions beyond the stated scope of the tool.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The tool can write generated files to disk and invoke external Morph editing, which is a sensitive capability because LLM output is inherently untrusted and may produce harmful or misleading changes. In a code-generation CLI this capability is somewhat aligned with intended functionality, but it still needs clear scope restrictions and safety controls to avoid unauthorized or dangerous modifications.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly advertises direct file writing but provides no warning that generated or modified files may overwrite user data, introduce insecure code, or require human review before execution. In a code-agent context, this omission increases the chance that users will trust and apply file changes automatically, which can lead to accidental damage or unsafe code being written to the repository.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The API key setup instructions tell users how to export and store a credential but omit basic guidance about treating the key as sensitive, avoiding commits, and limiting exposure in shell history or shared environments. While not an exploit by itself, this is a real security weakness because documentation strongly influences user behavior around secret handling.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script silently reads API credentials from multiple files in the user's home directory, which is a form of credential access that may surprise users and bypass their expectation that only explicit environment variables are used. In an agent/skill context, undisclosed secret discovery is more dangerous because the tool may run with broad filesystem access and users may not realize local auth stores are being consulted.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code sends both the user prompt and concatenated file contents to a remote third-party API endpoint without any explicit privacy warning, confirmation gate, or redaction step. In this skill context that is materially risky because local source files may contain proprietary code, secrets, or personal data, and the whole purpose of the script is to upload them for analysis or generation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The wrapper spawns the Python bridge with a full copy of process.env, which can include API keys, tokens, proxy settings, and other sensitive runtime secrets. Because this skill acts as a bridge to another component and may process user-controlled prompts/files, broad environment inheritance expands the blast radius if the Python side logs, forwards, or mishandles those values.

Vague Triggers

Low

• Confidence: 88% confidence
• Finding: The manifest description is broad and advertises powerful capabilities such as codebase analysis, refactoring, reasoning, and code generation, but it does not define when the skill should be invoked or what boundaries apply. In agent ecosystems, vague scope can cause overbroad routing or unintended invocation for sensitive tasks, increasing the chance that a high-capability external bridge is used in contexts the user did not intend.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: bridge/index.js:153