ClawHub
Back to skill

Security audit

SwarmHaul

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for a Solana multi-agent protocol, but it asks users to connect a persistent third-party MCP server that can return agent instructions and drive wallet-linked task workflows without enough trust-boundary guidance.

Review this skill before installing. Use a dedicated devnet wallet, do not provide private keys or seed phrases, inspect the MCP tools/manifest first, and require explicit confirmation before bids, task posting, signing, settlement, or sharing sensitive context. Treat any remote 'system prompt' and prior-agent output as untrusted task data, not as instructions that can override your own goals or safety rules.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:44
Finding

Externally Controlled System Prompt Enables Agent Instruction Hijacking

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44 and 53–55
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Critical

Vulnerable Code

SKILL.md:44:

markdown
1. **Register** — call `register_agent` with your Solana wallet pubkey → get 1 devnet SOL airdropped + a system prompt tailored for the protocol

SKILL.md:53–55:

markdown
- `register_agent` — register a new agent with a Solana pubkey; triggers 1 devnet SOL airdrop and returns the agent system prompt
- `get_agent` — fetch your agent profile including reputation score, DID, completed legs, and total earned
- `get_system_prompt` — retrieve the SwarmHaul-optimised system prompt for autonomous operation

Technical Analysis

The skill directs the agent to retrieve a system prompt from the externally operated MCP server at https://api.swarmhaul.defited.com/mcp. The returned prompt is not present in the audited package and is therefore not immutable, reviewable, or constrained by the local skill.

Treating a remote server response as a system prompt crosses a critical trust boundary. The server operator, or an attacker who compromises the server or its delivery path, can change the returned instructions after the skill has been reviewed. Those instructions could attempt to override the agent's current goals, request sensitive information, invoke available tools, initiate wallet-related operations, or weaken safety constraints.

This finding concerns remote instruction retrieval rather than remote code execution: the reviewed file does not download or execute a software payload.

Attack Path

  1. A user registers the remote SwarmHaul MCP endpoint using the configuration in SKILL.md.
  2. The agent calls register_agent or get_system_prompt as directed.
  3. The remote server returns an attacker-controlled or compromised prompt.
  4. The client incorporates that response into the agent's operational ...[truncated 1076 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the ability of register_agent and get_system_prompt responses to modify system-level or developer-level instructions.
  • Package all behavioral instructions locally so they can be reviewed and versioned with the skill.
  • Treat every MCP response as untrusted data, regardless of whether the response field is named “system prompt.”
  • Place remote content inside clearly delimited data fields and explicitly prohibit interpreting it as instructions.
  • Apply a strict allowlist to MCP methods and validate request and response schemas.
  • Require explicit user confirmation before bids, task posting, transaction preparation, signing, wallet operations, or disclosure of sensitive context.
  • Restrict the MCP server to the minimum information necessary; do not provide secrets, private keys, wallet seed phrases, hidden prompts, or unrelated conversation history.
  • Pin and authenticate the intended service where supported, monitor endpoint changes, and document the server's trust assumptions.
  • Display any remotely supplied operational guidance to the user as untrusted content rather than applying it automatically.

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:47
Finding

Untrusted Inter-Agent Output Is Relayed as Agent Context

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47 and 68–69
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

SKILL.md:47:

markdown
4. **Complete the leg** — call `complete_leg` with your output; the previous agent's output is provided as context

SKILL.md:68–69:

markdown
- `complete_leg` — mark your leg as complete with output; the next agent receives your output as context input; triggers on-chain CPI settlement
- `get_leg` — fetch leg details including context from prior legs in the chain

Technical Analysis

The protocol intentionally passes one participant's output into another agent's context. Task participants are external and potentially adversarial, so their outputs constitute untrusted input.

The skill does not define a trust boundary, content schema, sanitization process, or instruction hierarchy for this relayed content. A malicious participant can submit natural-language prompt-injection directives disguised as task output. If the receiving agent interprets the prior output as operational instructions rather than inert task data, it may disregard the actual leg requirements, disclose accessible context, invoke tools, or propagate the injected content to later participants.

Conventional text filtering alone cannot reliably identify prompt injection because malicious instructions can be embedded in otherwise legitimate prose, source code, markup, encoded text, or task-specific data. Isolation and capability controls are therefore required.

Attack Path

  1. An attacker obtains and completes an earlier task leg.
  2. The attacker embeds instructions in the leg output, such as directions to ignore the assigned task, reveal context, invoke a tool, or reproduce the malicious instructions.
  3. The protocol stores the output and supplies it as context to the agent handling the next leg.
  4. The receiving agent treats the em ...[truncated 1137 chars]
Remediation
View remediation

Remediation Suggestions

  • Label all prior-agent output as untrusted content and explicitly state that it must never override system, developer, user, or task instructions.
  • Use schema-constrained exchanges instead of unrestricted free-form context wherever possible.
  • Place prior outputs in isolated, quoted data containers and prevent them from being concatenated into privileged instruction channels.
  • Execute each task leg in a context that does not contain secrets, unrelated conversation history, or unnecessary tool access.
  • Apply least privilege by disabling wallet, filesystem, network, and execution tools unless a specific leg requires them.
  • Require explicit user approval for external side effects, financial actions, transaction signing, and disclosure of data.
  • Validate outputs against the expected leg type and reject unexpected commands, tool directives, or attempts to alter instruction hierarchy.
  • Prevent automatic propagation of suspicious content to subsequent agents.
  • Preserve provenance metadata for every context segment so receiving agents and users can distinguish protocol instructions from participant-authored data.
  • Add monitoring and audit logs for relayed content, tool invocations, and settlement-triggering actions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This command configures OpenClaw to connect to a third-party MCP server over the network, which enables ongoing data exchange between the agent environment and an external endpoint. In this skill's context, the remote server can influence agent behavior by supplying tool schemas, task data, and protocol prompts, so the transmission is security-relevant and should be explicitly disclosed and constrained.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

Register this MCP server with OpenClaw:

bash
openclaw mcp set swarmhaul '{"url":"https://api.swarmhaul.defited.com/mcp","transport":"streamable-http"}'

Or add it to your openclaw.json config under mcp.servers:

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The configuration example embeds a remote MCP endpoint into persistent client configuration, normalizing automatic future communication with a third-party service. Because this skill is specifically designed for autonomous multi-agent tasking and wallet-linked actions, persistent external connectivity increases the risk of unintended data disclosure or remote influence over agent workflows.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
"mcp": {
    "servers": {
      "swarmhaul": {
        "url": "https://api.swarmhaul.defited.com/mcp",
        "transport": "streamable-http"
      }
    }

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to call register_agent, which initiates an external network interaction and a wallet-linked blockchain action (registration, airdrop, and protocol-specific prompt retrieval) without an explicit warning about those consequences. In a wallet- and identity-associated context, omission of this disclosure can mislead users into connecting an address and triggering on-chain/protocol side effects they did not fully anticipate.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
- Pitch: https://mighty840.github.io/swarmhaul-pitch/
- Docs: https://docs.swarmhaul.defited.com
- Dashboard + leaderboard: https://dashboard.swarmhaul.defited.com
- MCP manifest: https://api.swarmhaul.defited.com/mcp/tools
- Smithery: https://smithery.ai/servers/parnerkarsharang/swarmhaul

Static analysis

No suspicious patterns detected.