ClawHub
Back to skill

Security audit

SWARM Safety

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local research framework guide, with ordinary install and localhost API risks but no evidence of hidden exfiltration or malicious behavior.

Install in a virtual environment or container, pin versions when reproducibility matters, and only enable the optional API on localhost. Do not put real secrets or PII in scenarios, and do not expose the unauthenticated development API to a network.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:37
Finding

Unpinned Third-Party Package Installation Creates a Supply-Chain Execution Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:37-45; skill.json:27-33
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: Medium

The skill directs users to install the swarm-safety package and several optional dependency sets without specifying immutable versions, package hashes, or a reviewed dependency lockfile.

Relevant code from SKILL.md:37-45:

bash
# From PyPI
pip install swarm-safety

# With LLM agent support
pip install swarm-safety[llm]

# Full development (all extras)
git clone https://github.com/swarm-ai-safety/swarm.git
cd swarm
pip install -e ".[dev,runtime]"

Relevant code from skill.json:27-33:

json
"install": {
  "pip": "pip install swarm-safety",
  "source": "pip install -e \".[dev,runtime]\"",
  "with_api": "pip install swarm-safety[api]",
  "with_llm": "pip install swarm-safety[llm]",
  "with_all": "pip install swarm-safety[all]"
}

Technical Analysis

A package installation can execute package build hooks and installs code that will subsequently execute when imported or invoked. Because the installation commands do not pin an exact reviewed release or verify artifact hashes, the installed content can change independently of this skill artifact.

Optional extras such as api, llm, runtime, and all also expand the transitive dependency graph. The audited project contains only SKILL.md and skill.json; it does not include the referenced package implementation, dependency manifests, lockfiles, hashes, or vendored source. Consequently, the behavior and integrity of the executable package and its transitive dependencies cannot be established from the audited artifact.

This finding does not establish that the current upstream package is malicious. It identifies an unsafe, mutable supply-chain trust boundary through which a compromised package release, compromised upstream account, dependency-confusio ...[truncated 1631 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the package to an exact, reviewed version rather than installing an unconstrained latest release.
  2. Publish a lockfile covering every supported optional dependency set, including all transitive dependency versions.
  3. Record cryptographic hashes for approved distributions and install with hash enforcement, such as pip --require-hashes.
  4. Reference an immutable Git commit when source installation is required instead of relying on a mutable default branch.
  5. Review package build configuration and dependency installation hooks before recommending execution.
  6. Install the package in an isolated virtual environment or container using a non-privileged account.
  7. Separate optional features so users install only the minimum dependency set required for their task.
  8. Add automated dependency vulnerability, provenance, and package-name-confusion checks to the release process.
  9. Include the reviewed package source or a verifiable source archive in the audit scope so its claimed behavior can be validated.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

Register Agent

bash
curl -X POST http://localhost:8000/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "YourAgent",

Static analysis

No suspicious patterns detected.