Security audit

Claude Swarm

Security checks for vulnerabilities and agentic risk

Overview

This skill openly provides multi-agent coding automation, but it grants agents broad unattended repository authority, including bypassed permissions, commits, pushes, and default main-branch integration.

Install only in a disposable or tightly sandboxed repository environment with credentials scoped to test remotes. Disable auto-merge and notifications unless explicitly needed, do not use it on protected production repositories, and review all generated branches before any push or merge.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/spawn-agent.sh:84
Finding: Autonomous Agents Run With Bypassed Permissions and Push Changes Without Human Approval
Content: View full analysis
&1 | tee "$REVIEW_OUTPUT" ``` ```bash cd "$WORK_DIR" git push origin "$BRANCH" --force-with-lease 2>/dev/null || git push origin "$BRANCH" 2>/dev/null || true ``` `scripts/integration-watcher.sh:130-136` ```bash AUTO_MERGE="${SWARM_AUTO_MERGE:-true}" if [ "$AUTO_MERGE" = "true" ]; then git push origin main 2>/dev/null && { echo "[integration] ✅ Pushed to main" bash "$SCRIPTS_DIR/notify.sh" "✅ Batch $BATCH_ID integrated and pushed to main" 2>/dev/null || true ...[truncated 2058 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/spawn-agent.sh:124
Finding: Unreviewed Project Dependencies and Lifecycle Scripts Are Installed Automatically
Content: View full analysis
/dev/null || true elif [ -f "package.json" ] && [ ! -d "node_modules" ]; then if [ -f "yarn.lock" ]; then yarn install 2>/dev/null || true elif [ -f "package-lock.json" ]; then npm install 2>/dev/null || true fi fi ``` ### Technical Analysis Spawning an agent automatically invokes `pip`, `yarn`, or `npm` based on files in the target repository. Dependency installation can execute arbitrary package installation hooks, including Python build/setup code and npm lifecycle scripts. The packages and lifecycle scripts inherit the privileges, environment variables, network access, and credentials of the user running the Skill. Dependency installation is not required merely to create a git worktree or launch an agent. Errors and diagnostics are suppressed with `2>/dev/null || true`, making malicious or unexpected installation behavior less visible. The presence of a lock file does not make execution safe if the lock file, registry, package version, or package itself is attacker-controlled. ### Attack Path 1. An attacker provides or modifies a repository containing a malicious `requirements.txt`, `package.json`, lock file, package, or lifecycle script. 2. A user invokes `spawn-agent.sh` against that repository. 3. The script detects the dependency manifest and automatically invokes the corresponding package manager. 4. The package manager retrieves and executes package installation or lifecycle code. 5. The malicious code accesses local files, environment variables, git credentials, API credentials, or network resources under the invoking user's ...[truncated 364 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/spawn-batch.sh:27
Finding: Batch Workflow Automatically Bypasses the Declared Endorsement Safety Gate
Content: View full analysis
}" mkdir -p "$SWARM_DIR/endorsements" echo "Endorsed at $(date)" > "$SWARM_DIR/endorsements/${TASK_ID}.endorsed" echo "✅ Task '$TASK_ID' endorsed → $SWARM_DIR/endorsements/${TASK_ID}.endorsed" ``` `scripts/spawn-agent.sh:54-60` ```bash ENDORSEMENT_FILE="$SWARM_DIR/endorsements/$TASK_ID.endorsed" if [ ! -f "$ENDORSEMENT_FILE" ]; then echo "⛔ ENDORSEMENT REQUIRED" echo " Task '$TASK_ID' has not been endorsed." echo "" echo " To endorse:" echo " bash $SCRIPTS_DIR/endorse-task.sh $TASK_ID" exit 1 fi ``` ### Technical Analysis The documentation characterizes endorsement as a safety control against uncontrolled agent spawning, but the standard batch workflow endorses every task automatically. No human confirmation occurs. An endorsement records only a task identifier and timestamp. It is not cryptographically bound to the task prompt, repository, repository revision, role, model, requested permissions, or batch definition. Consequently, a task's contents can be changed after endorsement without invalidating approval. Endorsements also are not consumed after use. The cooldown delays execution but does not provide authorization or integrity. ### Attack Path 1. An attacker supplies or modifies a tasks JSON file. 2. ` ...[truncated 772 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/endorse-task.sh:4
Finding: Unsanitized Task Identifiers Permit Path Traversal and Generated-File Corruption
Content: View full analysis
}" mkdir -p "$SWARM_DIR/endorsements" echo "Endorsed at $(date)" > "$SWARM_DIR/endorsements/${TASK_ID}.endorsed" echo "✅ Task '$TASK_ID' endorsed → $SWARM_DIR/endorsements/${TASK_ID}.endorsed" ``` `scripts/spawn-agent.sh:24-32` ```bash PROJECT_DIR="${1:?Usage: spawn-agent.sh [role] [model] [effort]}" TASK_ID="${2:?Missing task-id}" DESCRIPTION="${3:?Missing description}" ROLE="${4:-builder}" MODEL="${5:-}" EFFORT="${6:-}" PROJECT_NAME="$(basename "$PROJECT_DIR")" BRANCH="feat/$TASK_ID" TMUX_SESSION="claude-$TASK_ID" ``` `scripts/spawn-agent.sh:54-56, 106-108, 140-146` ```bash ENDORSEMENT_FILE="$SWARM_DIR/endorsements/$TASK_ID.endorsed" if [ ! -f "$ENDORSEMENT_FILE" ]; then ``` ```bash WORKTREE_DIR="${PROJECT_DIR}-worktrees/${TASK_ID}" ``` ```bash PROMPT_FILE="$SWARM_DIR/logs/${TMUX_SESSION}-prompt.md" mkdir -p "$SWARM_DIR/logs" printf '%s' "$PROMPT" > "$PROMPT_FILE" RUNNER_SCRIPT="$SWARM_DIR/logs/${TMUX_SESSION}-run.sh" ``` `scripts/spawn-agent.sh:220-224` ```bash TASKS_FILE="$SWARM_DIR/state/active-tasks.json" mkdir -p "$SWARM_DIR/state" if command -v jq &>/dev/null; then [ -f "$TASKS_FILE" ] || echo '[]' > "$TASKS_FILE" jq ". + [{\"id\": \"$TASK_ID\", \"tmux\": \"$TMUX_SESSION\", \"branch\": \"$BRANCH\", \"role\": \"$ROLE\", \"model\": \"$MODEL\", \"project\": \"$PROJECT_NAME\", \"started\": \"$(date -Iseconds)\"}]" "$TASKS_FILE" > "${TASKS_FILE}.tmp" && mv "${TASKS_FILE}.tmp" "$TASKS_FILE" fi ``` ### Technical Analysis `TASK_ID` is accepted without a character allowlist and reused in en ...[truncated 1909 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/notify.sh:19
Finding: Telegram Bot Token Is Exposed in Process Command-Line Arguments
Content: View full analysis
/dev/null || true fi ;; ``` ### Technical Analysis The Telegram bot token is embedded directly in curl's URL argument. Command-line arguments can be exposed through process inspection facilities, endpoint telemetry, diagnostic tools, shell tracing, or audit records. On systems where users can inspect one another's processes, another local account may capture the token while curl is running. The implementation also suppresses curl errors, reducing visibility into transport or authentication failures. The reviewed notification callers send operational task, project, batch, and review status; no direct repository-content transmission was identified in those messages. ### Attack Path 1. Telegram notifications are enabled and a bot token is configured. 2. `notify.sh` launches curl with the token embedded in its URL argument. 3. A local process monitor, another permitted user, or an auditing system records curl's command line. 4. The attacker extracts the bot token. 5. The attacker uses Telegram's Bot API to impersonate or abuse the bot within the token's permitted scope. ### Impact Assessment Exposure allows unauthorized use of the Telegram bot, potentially including sending spoofed messages, reading information available through permitted bot API methods, disrupting notifications, or exhausting service limits. The direct impact is limited to the permissions and chats accessible to the compromised bot token. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/notify.sh:9
Finding: Webhook JSON Payload Is Constructed Without Escaping Attacker-Controlled Message Data
Content: View full analysis
}" NOTIFY="${SWARM_NOTIFY:-none}" case "$NOTIFY" in webhook) if [ -n "${SWARM_WEBHOOK_URL:-}" ]; then curl -s -X POST "$SWARM_WEBHOOK_URL" \ -H "Content-Type: application/json" \ -d "{\"text\": \"$MSG\"}" 2>/dev/null || true fi ;; ``` ### Technical Analysis The message is interpolated directly into a JSON string without JSON encoding. Messages containing quotation marks, backslashes, newlines, or control characters can make the body invalid or change its JSON structure. Task and batch identifiers are included in notification messages elsewhere in the project and are not validated. Therefore, a crafted identifier can reach this interpolation point. Shell quoting prevents direct local shell-command injection in this statement, but it does not provide JSON escaping. ### Attack Path 1. An attacker supplies a crafted task or batch identifier containing JSON metacharacters. 2. A watcher incorporates that identifier into a notification message. 3. `notify.sh` inserts the message directly into the JSON body. 4. The resulting body is malformed or includes attacker-shaped JSON syntax. 5. The webhook endpoint misparses the notification, accepts unintended fields, or drops a security-relevant alert. ### Impact Assessment The likely impact is notification corruption, loss of operational alerts, spoofed message structure, or unintended behavior in a custom downstream webhook parser. This code does not by itself establish local command execution because the shell variable remains quoted. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (35)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
bash scripts/spawn-batch.sh "/path/to/project" "batch-1" "Description" /tmp/tasks.json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
bash scripts/spawn-batch.sh "/path/to/project" "batch-1" "Description" /tmp/tasks.json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
md
bash scripts/spawn-batch.sh "/path/to/project" "batch-1" "Description" /tmp/tasks.json

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The workflow description includes autonomous spawning, reviewer-created fixes and commits, sequential merges into main, conflict resolution, and optional pushing to main, but it does not provide strong warnings about destructive or high-trust repository operations. This is especially dangerous here because the skill explicitly uses non-interactive bypass permissions and background watchers, creating a credible path to unintended code changes, bad merges, or direct main-branch modification at scale.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The script recursively deletes a path constructed from a user-supplied project directory without verifying that the resolved path stays within an expected workspace or actually belongs to this tool. While quoting prevents shell injection, an attacker or mistaken caller can point the script at an unintended repository path and cause irreversible deletion of .claude/worktrees content there.
Content: Scanner excerpt · scripts/cleanup.sh (reported line 30)May include surrounding context.
sh
# Also clean .claude/worktrees if any if [ -d "$PROJECT_DIR/.claude/worktrees" ]; then rm -rf "$PROJECT_DIR/.claude/worktrees" echo " Removed: .claude/worktrees/" fi

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This skill is described as orchestration, but the script performs direct repository mutation by checking out main, pulling, merging agent branches, and later preparing to push integrated changes. In a multi-agent environment, this turns a coordinator into an autonomous code-integrator with the ability to alter protected project state, increasing the blast radius of any bad branch, prompt injection, or merge mistake.
Content: No source excerpt is available for this finding.

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · scripts/integration-watcher.sh (reported line 83)May include surrounding context.
sh
# Use Claude to resolve conflicts CONFLICTS=$(git diff --name-only --diff-filter=U 2>/dev/null || echo "") if [ -n "$CONFLICTS" ]; then claude --model opus --effort high --permission-mode bypassPermissions --print \ "Resolve the merge conflicts in these files: $CONFLICTS Keep the most complete version. For i18n files, combine both sets of translations.

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · scripts/integration-watcher.sh (reported line 106)May include surrounding context.
sh
# Use Claude to resolve conflicts CONFLICTS=$(git diff --name-only --diff-filter=U 2>/dev/null || echo "") if [ -n "$CONFLICTS" ]; then claude --model opus --effort high --permission-mode bypassPermissions --print \ "Resolve the merge conflicts in these files: $CONFLICTS Keep the most complete version. For i18n files, combine both sets of translations.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script invokes Claude with --permission-mode bypassPermissions during merge-conflict resolution and explicitly instructs it to modify files and commit changes. This gives an external agent unrestricted write capability inside the repository during a sensitive merge state, which can silently introduce insecure code, backdoors, or destructive changes without human review.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script authorizes Claude in bypass-permissions mode to edit files and create commits during conflict handling without notifying or prompting the user at the point of action. Because merge conflicts often contain attacker-controlled or untrusted content from branches, this creates a path for prompt-influenced autonomous changes to be committed under the guise of conflict resolution.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The integration review step grants Claude bypass-permissions and instructs it to run build commands, fix issues, and commit changes automatically. This effectively allows an LLM to execute a broad, repository-defined action surface during review, including potentially unsafe build steps or arbitrary modifications derived from untrusted project content.
Content: No source excerpt is available for this finding.

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Selecting an external model is not inherently unsafe, but here it is coupled with permission bypass and autonomous repository modification instructions, turning the external model invocation into a meaningful trust-boundary issue. The model receives branch/project context and is empowered to make changes, so compromise, prompt misbehavior, or misclassification can directly affect code integrity.
Content: Scanner excerpt · scripts/notify-on-complete.sh (reported line 57)May include surrounding context.
sh
# Get diff for review DIFF=$(git diff origin/main...HEAD --stat 2>/dev/null || echo "no diff") claude --model sonnet --effort medium --permission-mode bypassPermissions --print \ "Review the changes in this branch ($BRANCH) of $PROJECT_NAME. Files changed:

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script force-pushes the branch automatically after autonomous review rounds, which can overwrite remote history and discard collaborators' work if branch state diverges. Even with --force-with-lease first, the fallback push and lack of human confirmation make this a destructive operation in an orchestration context where many agents may act concurrently.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The dangerous parameter use is real because the script applies git push with history-rewriting semantics in an automated workflow. In a swarm orchestration setting, parameter abuse is more dangerous than usual: concurrent agents and non-interactive execution increase the chance of clobbering valid remote commits or masking unintended changes.
Content: Scanner excerpt · scripts/notify-on-complete.sh (reported line 87)May include surrounding context.
sh
# ─── Push final state ─────────────────────────────────────────────────────── cd "$WORK_DIR" git push origin "$BRANCH" --force-with-lease 2>/dev/null || git push origin "$BRANCH" 2>/dev/null || true echo "[watcher] Done with $TASK_ID"

Prompt Exfiltration via Tool

High

Category: System Prompt Leakage
Confidence: 87% confidence
Finding: The script writes the full task prompt to a log file under the swarm directory, which may expose sensitive instructions, credentials, internal URLs, or proprietary project details to other local users/processes or later automation. In an agentic workflow, prompts often contain operational context that should be treated as sensitive input, so persisting them broadens the exfiltration surface.
Content: Scanner excerpt · scripts/spawn-agent.sh (reported line 138)May include surrounding context.
sh
fi fi # ─── Save prompt to file ──────────────────────────────────────────────────── PROMPT_FILE="$SWARM_DIR/logs/${TMUX_SESSION}-prompt.md" mkdir -p "$SWARM_DIR/logs"

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The runner launches Claude with --permission-mode bypassPermissions, explicitly disabling normal safety/approval barriers for agent actions. Because the prompt also directs git and PR operations, this materially increases the likelihood that a prompt-injected or mistaken agent can perform unrestricted filesystem, shell, and remote-repo actions without user confirmation.
Content: No source excerpt is available for this finding.

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · scripts/spawn-agent.sh (reported line 163)May include surrounding context.
sh
run_agent() { echo "[runner] Starting claude/\$MODEL (effort: \$EFFORT) ..." claude --model "\$MODEL" --effort "\$EFFORT" --permission-mode bypassPermissions --print "\$PROMPT" } while true; do

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script invokes the agent in bypass-permissions mode without any explicit runtime warning or acknowledgment from the operator. In this skill's multi-agent automation context, that omission is especially dangerous because users may assume normal agent safeguards still apply while the agent is actually empowered to take unrestricted actions.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill clearly instructs use of shell scripts, tmux, git, and a CLI in non-interactive bypass mode, yet it declares no explicit tool scope or permissions. That mismatch can cause an orchestration skill with code-execution capability to be invoked without adequate guardrails, increasing the chance of unsafe repository modification, background process creation, and network-capable script execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger language is broad enough to match many normal coding situations, such as any parallel work or 2+ tasks, which can cause accidental invocation of a highly autonomous orchestration workflow. In this context, unintended activation is more dangerous because the skill is designed to spawn agents, manipulate git worktrees, and automate review/integration flows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The notification setup sends data to webhooks or Telegram but does not clearly warn that repository metadata, task details, diffs, or other sensitive content may leave the local environment. In a multi-agent coding workflow, completion notices and auto-review integrations can easily expose proprietary code or project information to third-party services if users are not warned and configurations are not constrained.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script performs irreversible rm -rf deletions on derived worktree paths, which is a safety-critical operation for a code file. Although it prints progress messages, it does not warn the user about destructive deletion in advance or request confirmation before removing directories.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: When --all is supplied, the script force-deletes local feat/* branches and deletes matching remote branches, which is an irreversible operation affecting repository state. The code logs progress, but it does not provide a specific warning about branch destruction or ask for confirmation before proceeding.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script automatically pushes to origin main when SWARM_AUTO_MERGE is true, with no interactive confirmation, no policy check, and no requirement for review success beyond a weak text match. This can publish incorrect or malicious integrated code directly to the primary branch, causing immediate supply-chain and operational impact.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script automatically invokes an LLM with bypassPermissions and explicitly instructs it to fix issues directly, commit, and later push changes, all without interactive approval. In a multi-agent coding skill this creates a real integrity risk: autonomous shell-driven code mutation can introduce unsafe changes, review evasion, or unintended repository modifications at scale.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.