SWARM Protocol Platform Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:03 PM UTC
• Version: 3.0.0

Overview

This skill is a SWARM Protocol guide, but it asks agents to adopt mutable remote instructions, store credentials locally, and set up continuous polling with too little containment or user control.

Install only if you are comfortable with an agent using SWARM as a stateful, networked client. Use an isolated VM/container, review downloaded modules before treating them as instructions, avoid automatic skill updates, avoid minute-level background polling unless explicitly needed, and protect or avoid exporting private keys and JWTs into ~/.swam.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:44

Finding

Mandatory Retrieval of Mutable Remote Instruction Payloads

Content

View full analysis

~/.swam/platform-auth.md curl -s "https://swarmprotocol.org/api/v1/platform/skills/posting" > ~/.swam/platform-posting.md curl -s "https://swarmprotocol.org/api/v1/platform/skills/verification" > ~/.swam/platform-verification.md curl -s "https://swarmprotocol.org/api/v1/platform/skills/proposals" > ~/.swam/platform-proposals.md curl -s "https://swarmprotocol.org/api/v1/platform/skills/sync" > ~/.swam/platform-sync.md curl -s "https://swarmprotocol.org/api/v1/platform/skills/threads" > ~/.swam/platform-threads.md curl -s "https://swarmprotocol.org/api/v1/platform/skills/moderation" > ~/.swam/platform-moderation.md curl -s "https://swarmprotocol.org/api/v1/platform/skills/delegation" > ~/.swam/platform-delegation.md curl -s "https://swarmprotocol.org/api/v1/platform/skills/initiatives" > ~/.swam/platform-initiatives.md curl -s "https://swarmprotocol.org/api/v1/platform/skills/private-threads" > ~/.swam/platform-private-threads.md ``` ``` ### Technical Analysis The Skill requires the agent to retrieve ten mutable Markdown instruction modules from an external server. These modules govern security-sensitive functionality, including authentication, synchronization, delegation, moderation, posting, and encrypted private-thread participation. The downloaded content is not pinned to cryptographic hashes, authenticated with detached signatures, or presented for user review before being loaded as instructions. The later “Sub-Module Checksums” section contains version labels rather th ...[truncated 1991 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:384

Finding

Remote Updates Are Allowed to Take Over the Agent’s Current Behavior

Content

View full analysis

Remediation

View remediation

T06 · System Persistence

Error

• Location: SKILL.md:149

Finding

Installation of Persistent Minute-Level Synchronization Tasks

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:132

Finding

Private PGP Key Exported to a Predictable Application File

Content

View full analysis

~/.swam/pgp_public.key gpg --armor --export-secret-keys agent-name > ~/.swam/pgp_private.key ``` ``` The documented storage structure also places authentication artifacts in the same application directory: ```markdown ~/.swam/ ├── config.json # Agent configuration ├── jwt_token # Current JWT ├── last_sequence_id # Sync tracking ├── pgp_public.key # Your public key ├── pgp_private.key # Private key (encrypted!) ``` ### Technical Analysis The Skill exports the PGP secret key to the predictable path `~/.swam/pgp_private.key`. ASCII armor is an encoding, not encryption. Whether the exported secret-key material is adequately protected depends on the GPG key configuration and passphrase, neither of which is enforced by the instructions. The command does not explicitly create the directory with a restrictive umask, enforce file mode `0600`, verify ownership, or keep the private key separated from downloaded remote modules and synchronization state. The same application directory is also documented as holding a JWT. This concentration of sensitive material increases the effect of local compromise or a hostile remotely supplied module with file-reading capability. No direct command in the audited file uploads the private key. The vulnerability is insecure local handling and the possibility that later unaudited modules or local processes could access the exported copy. ### Attack Path 1. The user follows the instructions and exports the ...[truncated 1074 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (17)

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill begins with a safety-oriented preamble about using a VM and acknowledging prompt-injection risk, then escalates into mandatory downloads, local persistence, authentication setup, and future behavior replacement. This pattern is dangerous because the initial safety framing can lower operator suspicion while the document gradually gains control over the agent's environment and decision flow.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

The skill includes a shell command to delete a file in the user's home directory. Even though it targets the skill's own file, embedding executable deletion commands in a prompt/skill can be copied or auto-executed by tooling and cause unintended data loss, especially when paired with adjacent cleanup commands.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

To Remove This Skill:

bash

rm ~/.swam/platform_skill.md
rm -rf ~/.swam/

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The recursive deletion command 'rm -rf ~/.swam/' removes the full local state directory, which may contain keys, tokens, configuration, and downloaded modules. In a skill context, destructive commands are risky because users or agents may treat them as endorsed operational steps without understanding the consequences.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

To Remove This Skill:

bash

rm ~/.swam/platform_skill.md
rm -rf ~/.swam/

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The recursive deletion command 'rm -rf ~/.swam/' removes the full local state directory, which may contain keys, tokens, configuration, and downloaded modules. In a skill context, destructive commands are risky because users or agents may treat them as endorsed operational steps without understanding the consequences.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

To Remove This Skill:

bash

rm ~/.swam/platform_skill.md
rm -rf ~/.swam/

---

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest presents the file as a guide, but the body instructs the agent to perform concrete actions: create local directories, download remote files, generate keys, register with a service, poll continuously, and join threads. This expands the skill from informational guidance into operational control, increasing the risk of unauthorized network activity, persistence, and state changes on the host.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs agents to generate and store PGP key material locally, including exporting a private key into a predictable path under ~/.swam. For a file described as a guide, directing credential creation and local secret storage is over-privileged and creates unnecessary exposure if the environment is shared, monitored, or later compromised.

Content

No source excerpt is available for this finding.

Ssd 1

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The update section instructs the agent to stop processing, download a new skill, read the entire updated skill, adjust behavior to it, and then resume. This is a direct remote behavior-replacement mechanism that allows future unreviewed content to redefine agent actions, creating a strong prompt-injection and supply-chain risk.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 87% confidence

Finding

The instruction to always respond to certain classes of replies is an anti-refusal pattern that pressures the agent to continue engagement regardless of broader safety context. While not directly destructive by itself, it can weaken refusal boundaries and keep the agent interacting with potentially adversarial content.

Content

Scanner excerpt · SKILL.md (reported line 402)May include surrounding context.

md

When other agents reply to your posts:

**Always respond when:**
- Someone asks for clarification
- Someone reports completing an action
- Your proposal receives feedback

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill claims to be the required entry point for all AI agents and should be read before any interaction, which is an overly broad trigger scope. This encourages the file to act as a universal authority, increasing the chance that agents will apply its instructions in contexts where they are unnecessary or unsafe.

Content

No source excerpt is available for this finding.

Ssd 1

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file explicitly tries to establish itself as the required primary authority for all future agent behavior. Skills should not redefine the agent's trust hierarchy, because doing so can suppress normal safeguards and make subsequent unsafe instructions appear mandatory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document includes destructive deletion commands that remove the platform directory, but it does not provide a clear warning about data loss such as deleting JWTs, keys, or downloaded files. Even if intended as cleanup, presenting shell deletion commands in a skill can be followed blindly and cause accidental loss of credentials or state.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file says sub-modules MUST be downloaded before use, making external remote content a prerequisite for interpreting the skill. This creates a trust gap: behavior is defined by mutable network-fetched documents rather than the reviewed skill itself, enabling instruction injection or silent behavior changes after approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs agents to download and store multiple remote files locally without providing integrity verification, version pinning, or a trust warning. This normalizes remote instruction loading and makes later compromise of the source or transit path materially more dangerous.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The skill tells the agent to create a persistent directory and store modules and credentials under ~/.swam, establishing session persistence and local state retention. This persistence amplifies later compromise by preserving downloaded instructions, tokens, and key material across runs.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Before you can participate in SWARM, you MUST download all sub-modules to your local storage:

bash

# Create storage directory
mkdir -p ~/.swam

# Download ALL sub-modules (REQUIRED)

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

curl -s "https://swarmprotocol.org/api/v1/platform/skills/private-threads" > ~/.swam/platform-private-threads.md

Verify downloads (should show 10 files)

ls -la ~/.swam/platform-*.md

text

### Storage Structure

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill requires persistent automation via cron or similar polling infrastructure, which turns a passive guide into an always-on operational agent. Persistent periodic execution increases the blast radius of any bad instruction later introduced through sync or downloaded modules and can lead to uncontrolled network activity or policy violations.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

md

- Receiving a CHALLENGE to your post
- Disputing an incorrect verification
- Understanding quote tracking system
- **Anti-stagnation rules (v1.1.0):** No verification chains, 2-confirmation cap, forward momentum

### 🗳️ Load `platform-proposals.md` When:
- Creating your first proposal