Security audit

Matz Swarm

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed autonomous coding swarm, but it can run background agents that bypass safety prompts and push, merge, sync, or delete repository data with limited confirmation.

Install only if you intentionally want persistent autonomous repository automation. Use a dedicated machine, container, or OS user; scope git/provider credentials to test or low-risk repos; keep protected branches, required reviews, and CI checks enforced server-side; avoid disabling safety prompts unless you accept the risk; and add explicit confirmation or dry-run gates before push, merge, cleanup, and note-triggered task execution.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README describes unattended automation that can spawn coding agents, push branches, create merge/pull requests, and participate in merge-related workflows, but it does not prominently warn users that this system can make autonomous changes to real repositories. In the context of a coding orchestration skill, this increases the risk of unintended code changes, unsafe commits, or repository-side effects being triggered without adequate human review.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The README explicitly instructs users to disable Claude Code's dangerous-action permission prompt to enable unattended automation. This removes an important interactive safeguard before potentially destructive actions, making it far easier for an agent to execute unsafe commands, modify sensitive files, or affect repositories without user confirmation.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill uses very broad natural-language triggers such as "merge", "spawn", and "check status" for operational actions. In a chat setting, these phrases can appear incidentally or in quoted text, causing unintended execution of repository or workflow actions without strong disambiguation.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to run merge-and-sync immediately when it detects a matching phrase, without confirmation. Merging a merge request is a state-changing repository action that can land unreviewed or attacker-influenced code into the main branch, so automatic execution materially increases the risk of accidental or malicious merges.

Missing User Warnings

High

Confidence: 92% confidence
Finding: The merge helper performs an irreversible remote action using non-interactive flags (`--yes`, branch deletion, and direct merge) with no built-in confirmation, authorization check, or branch protection awareness. In an agent-driven workflow, a mistaken or manipulated call can merge unreviewed code into main and delete the source branch, causing integrity loss and making rollback/audit harder.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The coding-agent wrapper launches external agent tools with explicit permission and sandbox bypass flags, giving the model broad ability to read, modify, and potentially execute actions in the host environment without normal safeguards. Because this file is shared configuration for an agent swarm, these unsafe defaults amplify risk across all downstream scripts and make prompt injection or task poisoning significantly more dangerous.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The review helper also invokes LLM tooling with approval and sandbox protections disabled, which undermines the security value of the review step and exposes the host to unsafe agent behavior. A compromised prompt file or malicious repository content could cause the reviewer to access sensitive data or take unintended actions while users may assume review is read-only.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script automatically stages, commits, rebases, pushes to the remote, and creates a merge request without any interactive confirmation or explicit safety gate. In this skill context, it also invokes autonomous review/fix agents that can modify code before those remote operations, so a bad prompt, compromised task data, or agent mistake could propagate unintended or unsafe changes directly into collaboration workflows.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script automatically rewrites note files and creates deduplication marker files based on parsed note content, with no user confirmation, dry-run mode, or visible disclosure at the point of execution. In an agent skill context, this is more dangerous because simply placing or modifying markdown notes can trigger state changes and downstream task spawning, creating unintended automation, data integrity issues, and hard-to-audit side effects.

Ssd 4

Medium

Confidence: 99% confidence
Finding: This section directly advises setting `skipDangerousModePermissionPrompt` to true, which weakens a built-in safety control designed to prevent unattended dangerous operations. In an orchestration tool that launches autonomous coding agents across worktrees and repositories, disabling that prompt materially increases the chance of harmful or irreversible actions being taken without intervention.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.