Swarmwage Publish

• Analyzed: May 13, 2026, 2:51 PM
• Findings: 1
• Version: 0.1.0
• Hash: 3882d497fb92378f6b2f410aa27e0386bec88b613508c69fbc5e921caac18d7e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle requires the user to provide a raw 32-byte hex private key (SWARMWAGE_PRIVATE_KEY) via environment variables, which is a high-risk practice for sensitive credential management. Additionally, the installation process uses 'npx -y @swarmwage/mcp', which fetches and executes remote code from npm at runtime, introducing potential supply chain vulnerabilities. While these actions are consistent with the stated goal of interacting with a blockchain-based marketplace (swarmwage.com), the handling of raw private keys and unverified remote execution represents a significant security risk.