Security checks across malware telemetry and agentic risk
This is a legitimate multi-agent coding tool, but it gives background agents broad unattended authority to install dependencies, change code, push branches, and potentially push directly to main.
Install only if you intentionally want autonomous Claude Code agents to modify, commit, push, review, and integrate repository code. Before use, set SWARM_AUTO_MERGE=false, remove or gate automatic dependency installs, avoid bypassPermissions unless you deliberately accept that risk, run on a fork or disposable branch, verify active git/GitHub/Claude credentials, disable external notifications unless needed, and monitor/stop the tmux watcher processes. Static scan was clean and VirusTotal was pending, so this Review verdict is based on artifact-backed autonomy and repository-impact concerns, not malware telemetry.
case "$NOTIFY" in
webhook)
if [ -n "${SWARM_WEBHOOK_URL:-}" ]; then
curl -s -X POST "$SWARM_WEBHOOK_URL" \
-H "Content-Type: application/json" \
-d "{\"text\": \"$MSG\"}" 2>/dev/null || true
fi;;
telegram)
if [ -n "${SWARM_TELEGRAM_BOT_TOKEN:-}" ] && [ -n "${SWARM_TELEGRAM_CHAT_ID:-}" ]; then
curl -s "https://api.telegram.org/bot${SWARM_TELEGRAM_BOT_TOKEN}/sendMessage" \
-d "chat_id=${SWARM_TELEGRAM_CHAT_ID}" \
-d "text=${MSG}" \
-d "parse_mode=Markdown" 2>/dev/null || true;;
telegram)
if [ -n "${SWARM_TELEGRAM_BOT_TOKEN:-}" ] && [ -n "${SWARM_TELEGRAM_CHAT_ID:-}" ]; then
curl -s "https://api.telegram.org/bot${SWARM_TELEGRAM_BOT_TOKEN}/sendMessage" \
-d "chat_id=${SWARM_TELEGRAM_CHAT_ID}" \
-d "text=${MSG}" \
-d "parse_mode=Markdown" 2>/dev/null || trueVirusTotal findings are pending for this skill version.