openclaw skill for swarms ai

Build and orchestrate multi-agent AI systems using the Swarms API. Use when creating single agents, multi-agent swarms (sequential, concurrent, hierarchical,...

Security Scan

The skill's purpose (orchestrating multi-agent swarms) mostly matches its instructions, but there are several unexplained and risky gaps — notably missing declared credentials (API keys, Solana private keys) and instructions that enable autonomous sub-agents and file operations which could expose secrets.

Purpose & Capability

The name/description match the content: the SKILL.md documents Swarms API endpoints, swarm architectures, streaming, marketplace token launches, and sub-agent delegation — all coherent with a 'swarms' orchestration skill. However, the examples rely on an API key (x-api-key) and Solana wallet private keys, yet the registry metadata declares no required environment variables or primary credential. That mismatch (declaring no credentials while the instructions require API keys and wallet keys) is unexplained and should be clarified.

Instruction Scope

The runtime instructions include examples that embed/submit highly sensitive material (Solana private_key in JSON payload; wallet private keys in ATP headers) and describe enabling autonomous modes (max_loops: "auto") with internal tools that include create_file/read_file/list_directory/delete_file and create_sub_agent/assign_task. While the skill does not directly instruct reading local host files, the documentation exposes mechanisms that — if used — could cause agents to create sub-agents, perform file operations, and transmit data. The ATP flow also describes sending wallet keys in requests. These instruction-level choices broaden the attack surface and are not scoped or limited in the skill metadata.

Install Mechanism

This is an instruction-only skill with no install spec and no code files — lowest install risk. Nothing is written to disk by the skill itself.

Credentials

Examples and reference docs clearly require an API key (x-api-key / Authorization: Bearer) and—in marketplace/token launch and ATP—Solana wallet private keys or wallet_private_key headers. Yet requires.env and primary credential are empty. Requesting wallet private keys inside API requests is high-risk and should have explicit handling guidance (never store/log, use ephemeral/test keys, use signing services or delegated custody). The skill asks for sensitive secrets in-band without declaring them in metadata or advising safer alternatives.

Persistence & Privilege

always:false and no install means the skill won't be force-installed. However, the docs encourage configurations that enable autonomous loops (max_loops: "auto") and internal tools that can spawn sub-agents and perform file ops. Combined with agent autonomy (model invocation not disabled), this can enable long-running autonomous behaviors that interact with external systems and files — a legitimate capability but one that raises the blast radius if misused. The skill does not request persistent privileges itself, but usage patterns it documents can grant broad runtime powers.

What to consider before installing

Before installing or enabling this skill, get answers to these questions: (1) Which credentials does the skill actually require? The examples use x-api-key and Solana private keys but the metadata lists none — the publisher should declare required env vars and their minimum privileges. (2) Never paste or upload mainnet private keys into requests; ask for alternatives (ephemeral/test wallets, delegated signing/custody, or a signing service). (3) Confirm whether agents/sub-agents can access your host filesystem or other agent credentials — if so, restrict or disable "max_loops: \"auto\"" and file operation tools unless absolutely necessary. (4) Verify the API endpoints and publisher (source/homepage are missing); only use limited-scope API keys and testnet tokens until you trust the service. If the publisher cannot justify the missing credential declarations and the choice to send private keys in requests, treat the skill as risky and avoid installing or using autonomous modes.

Swarms AI — Multi-Agent Orchestration

Build production-grade multi-agent systems using the Swarms API platform. Supports single agents, reasoning agents, and swarms of 3–10,000+ agents with 20+ architecture patterns.

Quick Reference

• Base URL: https://api.swarms.world
• Auth: x-api-key header with API key from swarms.world/platform/api-keys
• Docs index: https://docs.swarms.ai/llms.txt
• Python SDK: pip install swarms-client
• Marketplace: swarms.world

Architecture Tiers

Tier	Name	Agents	Endpoint
1	Individual Agent	1	/v1/agent/completions
2	Reasoning Agent	1-2 internal	/v1/reasoning-agent/completions
3	Multi-Agent Swarm	3–10,000+	/v1/swarm/completions

Workflow

1. Single Agent

import requests

payload = {
    "agent_config": {
        "agent_name": "MyAgent",
        "description": "Purpose of the agent",
        "system_prompt": "You are...",
        "model_name": "gpt-4o",  # or claude-sonnet-4-20250514, etc.
        "role": "worker",
        "max_loops": 1,
        "max_tokens": 8192,
        "temperature": 0.5,
        "auto_generate_prompt": False,
        "tools_list_dictionary": None
    },
    "task": "Your task here"
}

response = requests.post(
    "https://api.swarms.world/v1/agent/completions",
    headers={"x-api-key": API_KEY, "Content-Type": "application/json"},
    json=payload
)

2. Multi-Agent Swarm

payload = {
    "name": "My Swarm",
    "description": "What this swarm does",
    "agents": [
        {
            "agent_name": "Agent1",
            "description": "Role 1",
            "system_prompt": "You are...",
            "model_name": "gpt-4o",
            "role": "worker",
            "max_loops": 1,
            "max_tokens": 8192,
            "temperature": 0.5
        },
        {
            "agent_name": "Agent2",
            "description": "Role 2",
            "system_prompt": "You are...",
            "model_name": "claude-sonnet-4-20250514",
            "role": "worker",
            "max_loops": 1,
            "max_tokens": 8192,
            "temperature": 0.5
        }
    ],
    "max_loops": 1,
    "swarm_type": "SequentialWorkflow",  # See architecture table
    "task": "Your task here"
}

response = requests.post(
    "https://api.swarms.world/v1/swarm/completions",
    headers={"x-api-key": API_KEY, "Content-Type": "application/json"},
    json=payload
)

3. Token Launch (Solana)

payload = {
    "name": "My Agent Token",
    "description": "Agent description",
    "ticker": "MAG",
    "private_key": "[1,2,3,...]"  # Solana wallet private key
}

response = requests.post(
    "https://swarms.world/api/token/launch",
    headers={"Authorization": "Bearer API_KEY", "Content-Type": "application/json"},
    json=payload
)
# Returns: token_address, pool_address, listing_url
# Cost: ~0.04 SOL

Available Swarm Architectures

Use the swarm_type parameter:

Type	Description	Best For
SequentialWorkflow	Linear pipeline, each agent builds on previous	Step-by-step processing
ConcurrentWorkflow	Parallel execution	Independent tasks, speed
AgentRearrange	Dynamic agent reordering	Adaptive workflows
MixtureOfAgents	Specialist agent selection	Multi-domain tasks
MultiAgentRouter	Intelligent task routing	Large-scale distribution
HierarchicalSwarm	Nested hierarchies with delegation	Complex org structures
MajorityVoting	Consensus across agents	Decision making
BatchedGridWorkflow	Grid pattern execution	Multi-task × multi-agent
GraphWorkflow	Directed graph of agent nodes	Complex dependencies
GroupChat	Agent discussion	Collaborative brainstorming
InteractiveGroupChat	Real-time agent interaction	Dynamic collaboration
AutoSwarmBuilder	Auto-generate optimal swarm	When unsure of architecture
HeavySwarm	High-capacity processing	Large workloads
DebateWithJudge	Structured debate	Adversarial evaluation
RoundRobin	Round-robin distribution	Even load distribution
MALT	Multi-agent learning	Training systems
CouncilAsAJudge	Expert panel evaluation	Quality assessment
LLMCouncil	LM council for decisions	Group decision making
AdvancedResearch	Research workflows	Deep research
auto	Auto-select best type	Default/unknown

Agent Config Parameters

Param	Type	Default	Description
agent_name	string	—	Unique agent identifier
description	string	—	Agent purpose
system_prompt	string	—	Behavior instructions
model_name	string	gpt-4.1	AI model (gpt-4o, claude-sonnet-4-20250514, etc.)
role	string	worker	Agent role in swarm
max_loops	int/string	1	Iterations ("auto" for autonomous)
max_tokens	int	8192	Max response length
temperature	float	0.5	Creativity (0.0–2.0)
auto_generate_prompt	bool	false	Auto-enhance system prompt
tools_list_dictionary	list	—	OpenAPI-style tool definitions
streaming_on	bool	false	Enable SSE streaming
mcp_url	string	—	MCP server URL
selected_tools	list	all safe	Restrict available tools

Rules

• Always use environment variables for API keys — never hardcode.
• Set appropriate max_loops — use "auto" only when sub-agent delegation is needed.
• Match swarm_type to use case (see architecture table).
• For streaming, set streaming_on: true and parse SSE events (metadata → chunks → usage → done).
• Token launches cost ~0.04 SOL from the provided wallet.
• Batch endpoint (/v1/swarm/batch/completions) requires Pro/Ultra/Premium tier.
• Reasoning agents (/v1/reasoning-agent/completions) require Pro+ tier.

Resource Map

Topic	Reference
Full API architecture & tiers	references/architecture.md
Sub-agent delegation patterns	references/sub-agents.md
ATP payment protocol (Solana)	references/atp-protocol.md
Marketplace publishing	references/marketplace.md
Streaming implementation	references/streaming.md
Tools integration	references/tools.md
All docs pages	https://docs.swarms.ai/llms.txt

Read references only when the task requires that specific depth.