SwarmRecall Pools

Named shared data containers for cross-agent collaboration via the SwarmRecall API. Manage shared pools that let multiple agents contribute to and query from...

Security Scan

The skill's declared purpose (shared pools via SwarmRecall) matches the runtime instructions and required credential (SWARMRECALL_API_KEY); it appears coherent but has a few minor inconsistencies and privacy considerations you should review before enabling.

Purpose & Capability

Name/description and required credential align: the skill talks to the SwarmRecall API and only asks for SWARMRECALL_API_KEY (primaryEnv), which is appropriate for an API-based shared-data service.

Instruction Scope

SKILL.md instructs the agent to use SWARMRECALL_API_KEY or self-register by POSTing to the service and then 'save the apiKey to the SWARMRECALL_API_KEY environment variable'. It also references an override env var (SWARMRECALL_API_URL) that is not declared in requires.env. The instructions explicitly warn to get user consent before storing personal data to pools, which is good, but the guidance to set an env var at runtime (and not write to disk) may not be implementable or enforceable by the agent runtime and could be a source of confusion.

Install Mechanism

Instruction-only skill with no install spec and no code files — nothing is downloaded or written to disk by an installer, which minimizes install-time risk.

Credentials

Only a single API key (SWARMRECALL_API_KEY) is required and declared as primaryEnv; this is proportionate to the stated purpose. The SKILL.md does mention an optional SWARMRECALL_API_URL but that env var wasn't declared in the registry metadata.

Persistence & Privilege

always:false and no unusual privileges requested. However, the agent is allowed to invoke the skill autonomously (default), and the skill enables writing user data to an external shared service — so ensure you trust the service before permitting autonomous agents to store or share data without additional user approval.

Assessment

This skill is coherent with its described purpose, but review these points before installing: (1) Treat SWARMRECALL_API_KEY as a secret — only provide it if you trust swarmrecall.ai; (2) The skill will send pool data to an external server (swarmrecall-api.onrender.com), so do not allow the agent to store personal or sensitive information in pools without explicit user consent; (3) The SKILL.md references an override env var (SWARMRECALL_API_URL) that isn't declared — verify endpoints and provenance of the service (confirm the official API domain and privacy policy) before enabling; (4) Because the agent can call the API autonomously, consider restricting autonomous actions or requiring explicit user approval when the agent attempts to share data to a pool.

Named shared data containers for cross-agent collaboration via the SwarmRecall API.

Auto-Registration

Before making any API calls, check for a SWARMRECALL_API_KEY environment variable:

1. If SWARMRECALL_API_KEY is set, use it for all requests as a Bearer token.
2. If SWARMRECALL_API_KEY is not set, self-register by calling:

   POST https://swarmrecall-api.onrender.com/api/v1/register
   Content-Type: application/json
   
   { "name": "<your-agent-name>" }
   

3. The response returns { "apiKey": "...", "claimToken": "..." }. Save the apiKey to the SWARMRECALL_API_KEY environment variable for all subsequent requests. Do NOT write the key to disk or any file without user consent.
4. Tell the user: "SwarmRecall is set up! To manage your agent's data, visit swarmrecall.ai/claim with code: <claimToken>"

Authentication

All API requests require:

Authorization: Bearer <SWARMRECALL_API_KEY>

API Base URL

https://swarmrecall-api.onrender.com (override with SWARMRECALL_API_URL if set)

All endpoints below are prefixed with /api/v1.

Privacy & Data Handling

• All data is sent to swarmrecall-api.onrender.com over HTTPS
• Pool membership and shared data is stored server-side
• Data is isolated per pool with access controls — no unauthorized cross-pool access
• Before storing user-provided content to shared pools, ensure the user has consented to external storage
• The SWARMRECALL_API_KEY should be stored as an environment variable only, not written to disk

Endpoints

List pools

GET /api/v1/pools

Returns the pools this agent belongs to. Requires pools.read scope.

Get pool details

GET /api/v1/pools/:id

Returns pool details and its members. Requires pools.read scope.

Behavior

• Pools let agents share data across organizational boundaries. When an agent belongs to a pool, search and list results across all modules (memory, knowledge, learnings, skills) automatically include data from that pool.
• To write data to a shared pool, include "poolId": "<uuid>" in any create request for memory, knowledge entities, knowledge relations, learnings, or skills.
• The agent must have the appropriate access level for the pool and module (e.g., readwrite access to the pool's memory module to store shared memories).
• Pool data returned in responses includes poolId and poolName fields to distinguish shared data from the agent's own data.