Agent Swarm Dev Team

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:13 AM UTC
• Version: 1.0.0

Overview

This skill is a multi-agent coding orchestrator, but it defaults spawned agents into unsafe permission-bypass modes and writes to a hard-coded external install path.

Review this skill before installing. It is not clearly malicious, but it is designed to coordinate long-running coding agents and its defaults can disable important safety boundaries. Only use it in an isolated workspace or container, remove the dangerous default agent arguments, and fix the hard-coded /Users/xufan65 path before running the initializer.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: config/settings.json:2

Finding

AI Agents Are Configured to Bypass Sandbox and Permission Controls

Content

View full analysis

Vulnerability Details

File Location: config/settings.json, lines 2-12
Vulnerability Type: Unsafe privilege and approval bypass configuration
Risk Level: High

Vulnerable Code

json

"agents": {
  "codex": {
    "enabled": true,
    "model": "gpt-5.3-codex",
    "defaultArgs": "--dangerously-bypass-approvals-and-sandbox"
  },
  "claude": {
    "enabled": true,
    "model": "claude-opus-4.5",
    "defaultArgs": "--dangerously-skip-permissions"
  }
}

Technical Analysis

The default command-line arguments explicitly disable the security boundaries of both configured coding agents:

• --dangerously-bypass-approvals-and-sandbox directs Codex to bypass command approval and sandbox restrictions.
• --dangerously-skip-permissions directs Claude Code to skip its normal permission checks.

Coding agents commonly process repository content, issue descriptions, prompts, generated code, and command output. Some of those inputs may be untrusted. Disabling sandboxing and approval checks removes defense-in-depth controls intended to prevent model-generated or prompt-injected commands from accessing unrelated files or executing dangerous system operations.

The audited package does not include the advertised agent runner, so the included code does not itself launch an agent with these arguments. Exploitation therefore depends on an external or subsequently installed runner consuming the defaultArgs values. Nevertheless, this is the package's explicit default configuration and creates an unsafe privilege boundary if used as intended.

Attack Path

1. The user initializes or deploys the skill and uses an agent runner that reads config/settings.json.
2. The runner starts Codex or Claude Code with the configured defaultArgs.
3. The agent processes attacker-influenced content, such as a repository file, issue description, task prompt, or build output containing malicious instructions.

...[truncated 1199 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both dangerous default arguments:
   • --dangerously-bypass-approvals-and-sandbox
   • --dangerously-skip-permissions
2. Run agents in a sandbox with access limited to the assigned worktree.
3. Require explicit user approval for shell execution, network access, credential access, and modifications outside the assigned repository.
4. Use per-task allowlists for commands and filesystem paths rather than globally bypassing controls.
5. Run each agent under a dedicated, low-privilege operating-system account or isolated container.
6. Do not expose SSH keys, cloud credentials, package registry tokens, or unrestricted authenticated CLI sessions to agent processes.
7. Validate any runner consuming defaultArgs and reject known permission-bypass flags by default.
8. Record security-relevant agent actions in tamper-resistant logs and alert on attempts to access paths outside the assigned worktree.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/init-swarm.cjs:15

Finding

Initialization Script Modifies a Hard-Coded External Directory and Trusts Pre-Existing Scripts

Content

View full analysis

Vulnerability Details

File Location: scripts/init-swarm.cjs, lines 15-16, 39-46, and 105-106
Vulnerability Type: Unsafe external path handling and unvalidated file permission changes
Risk Level: Medium

Vulnerable Code

js

const SKILL_DIR = '/Users/xufan65/.openclaw/workspace/skills/agent-swarm-dev-team';
const CLAWDBOT_DIR = path.join(SKILL_DIR, '.clawdbot');

js

const scripts = [
    path.join(CLAWDBOT_DIR, 'run-agent.sh'),
    path.join(CLAWDBOT_DIR, 'check-agents.sh')
];

scripts.forEach(script => {
    if (fs.existsSync(script)) {
        fs.chmodSync(script, '755');
        console.log(`  ✅ ${path.basename(script)}`);
    } else {
        console.log(`  ⚠️  ${path.basename(script)} (不存在)`);
    }
});

js

const readmePath = path.join(CLAWDBOT_DIR, 'README.md');
fs.writeFileSync(readmePath, readme);

Technical Analysis

The initialization script does not derive its working directory from its actual installation path. Instead, it always targets a fixed user-specific directory:

text

/Users/xufan65/.openclaw/workspace/skills/agent-swarm-dev-team

Consequently, executing the package from another location still creates directories and writes files beneath that unrelated path. The script also checks for two shell scripts that are not included in the audited package and changes any files found at those paths to mode 755.

fs.existsSync() only establishes that a filesystem entry exists. It does not verify that the entry is a regular file, that it belongs to this package, that its content is trusted, or that it is not a symbolic link. The initialization process can therefore make pre-existing, unvalidated content executable. It also overwrites .clawdbot/README.md without confirming that the destination belongs to the current installation.

Changing a file to executable mode does not execute it by itself. Exploitation requires the user or ano ...[truncated 1957 chars]

Remediation

View remediation

Remediation Suggestions

1. Derive the installation directory from the script's real location rather than using an absolute user-specific path. For example:

   js

   const SKILL_DIR = path.resolve(__dirname, '..');
   const CLAWDBOT_DIR = path.join(SKILL_DIR, '.clawdbot');
   

2. Resolve the final target path and verify that it remains within the expected project root before every filesystem operation.

3. Ship required scripts as package files rather than trusting files that happen to exist at expected paths.

4. Before changing permissions, use fs.lstatSync() to reject symbolic links and verify that the entry is a regular file.

5. Verify trusted scripts with package-integrity metadata or cryptographic hashes before making them executable.

6. Create new files with restrictive permissions and avoid changing permissions on unknown pre-existing entries.

7. Do not overwrite an existing README without explicit confirmation. Use exclusive creation or an atomic, validated update process.

8. Remove instructions that direct users to execute scripts absent from the package.

9. Fail safely when the destination contains unexpected files rather than silently trusting or modifying them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The configuration explicitly launches spawned coding agents with permission- and sandbox-bypass flags: '--dangerously-bypass-approvals-and-sandbox' for Codex and '--dangerously-skip-permissions' for Claude. This removes key safety controls and allows autonomous agents to execute filesystem, git, network, or other sensitive actions without human approval, which is not inherently required for simple multi-agent orchestration and materially increases the blast radius of prompt injection, bad code generation, or tool misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly documents the ability to send commands into active tmux sessions and to auto-respawn failed agents, but it does not warn users about the operational and security risks of controlling long-running agent processes this way. In a multi-agent coding environment, this can lead to unintended command injection into active sessions, uncontrolled task continuation, or repeated execution loops that amplify mistakes or unsafe actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script’s comments, console messages, and generated README are written in Chinese throughout, including operational instructions shown to the user. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The natural-language instructions and headings are predominantly in Chinese, and the file does not state that this is a China-specific or Chinese-only skill nor provide an alternative language option. Per the policy, forcing a specific language without user opt-in can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language description is entirely in Chinese and provides no indication that users can choose another language or that the package is intentionally limited to a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/init-swarm.cjs:65